tor-mtplace[.]net

Analysis of tor-mtplace.net indicates that the domain was actively used for phishing before being taken offline. The site was registered on February 11, 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure (AS13335) with the IP address 188.114.96.3 located in the United States. DNS resolution is served by kyle.ns.cloudflare.com and tani.ns.cloudflare.com. No SSL certificate was observed, meaning the site operated without HTTPS encryption.

The only visible page element is the title "TOP," and no further content was captured before the takedown. VirusTotal scanned the domain and recorded three detections out of ninety‑three security vendors, confirming malicious classification. The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy feed, reinforcing the phishing designation. Current status is offline, so real‑time behavior cannot be verified, and the lack of SSL prevents assessment of transport‑layer security.

Defenders should immediately block tor-mtplace.net and its resolved IP 188.114.96.3 at perimeter and DNS filtering points. Continuous monitoring of the associated Cloudflare nameservers is advised to detect any re‑registration attempts or similar sub‑domains. Given the Cloudflare hosting, consider applying generic Cloudflare block rules for newly observed domains that share the same naming pattern. Threat intelligence platforms should ingest the seed identifier 7f763f and the observed indicators to enrich correlation with other potential phishing campaigns.