torzon-dnm[.]com

PhishDestroy has confirmed that torzon-dnm.com is a generic phishing site impersonating Torzon Market, a darknet marketplace. The domain, which was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, carries a page title of "Torzon Onion | Torzon Market — Darknet Marketplace Information Portal" and is designed to harvest login credentials from unsuspecting users. No specific drainer kit was identified, but the site poses a clear threat to anyone seeking access to the darknet marketplace.

Technical indicators underscore the malicious nature of this domain. VirusTotal shows a detection rate of 1 out of 95 security vendors, with the domain appearing on one security blocklist. The SSL certificate was issued by Let's Encrypt (E8), and the domain resolves to IP address 104.21.56.112. AlienVault OTX recorded the domain in one threat intelligence pulse. The domain was created on May 15, 2026, which is notably in the future, suggesting possible data manipulation or a deliberate attempt to evade detection. Google Safe Browsing (GSB) status was not provided, but the presence on a blocklist confirms its malicious reputation.

Currently, the domain has been taken offline, mitigating immediate risk. However, users who may have visited the site or entered credentials should consider their accounts compromised and take necessary precautions. PhishDestroy advises all users to verify any link claiming to represent Torzon Market through official channels and to avoid clicking on unsolicited links. Remaining risk includes potential copycat domains and the possibility that the site may come back under a different IP or registrar. Vigilance is key when dealing with darknet marketplace portals.