torzon-market-url[.]sbs

This domain, torzon-market-url.sbs, was registered on July 25, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and delegated to Cloudflare nameservers adel.ns.cloudflare.com and javon.ns.cloudflare.com. DNS resolution points to the IP address 104.21.92.127, which is part of Cloudflare’s global edge network. The domain is currently active and continues to resolve, indicating that the underlying infrastructure remains operational. Threat intelligence indicates that the site is being used for a generic phishing campaign; two of ninety‑one VirusTotal security vendors have flagged the domain, suggesting that at least a minority of scanners have detected malicious content.

It is listed on a single security blocklist and has been blocked by the PhishDestroy sinkhole, demonstrating that some defensive feeds are already ingesting the indicator. No additional public reputation scores, SSL certificate details, or HTTP response codes have been published, so the exact nature of the hosted page (e.g., login prompt, credential‑harvesting form) cannot be confirmed at this time. Defenders should add torzon-market-url.sbs to URL filtering rules, sinkhole or block the IP 104.21.92.127 at the network perimeter, and monitor DNS queries for the associated Cloudflare nameservers. Because the domain leverages Cloudflare’s CDN, legitimate traffic may also use the same IP range, so contextual analysis of request patterns is recommended.

Continuous re‑query of VirusTotal and other sandbox services is advised to capture any changes in detection rates. Organizations should also educate users about unsolicited communications that reference the domain, as the short lifespan (three days from registration to reporting) suggests a rapid‑deployment phishing operation. The combination of recent registration, active Cloudflare hosting, and partial detection by security vendors makes torzon-market-url.sbs a high‑risk indicator that warrants immediate inclusion in defensive controls.