torzondarknet[.]link

This domain, torzondarknet.link, is flagged for credential theft targeting users of the Torzon darknet market. Analysis indicates the infrastructure impersonates Torzon Market, presenting a fraudulent portal titled 'Torzon Market | Verified Onion Links & Mirrors' to harvest login credentials, payment details, or other sensitive user data. No direct evidence of a crypto drainer kit was observed, but the credential theft focus aligns with common darknet market phishing tactics, where stolen accounts are later exploited for financial fraud or resale on underground forums.

Infrastructure analysis reveals the domain was registered on September 30, 2025, through TUCOWS.COM, CO., and resolves to the IP address 104.21.73.176. The SSL certificate is issued by Google Trust Services, a common tactic to lend false legitimacy. VirusTotal reports 5 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. AlienVault OTX includes the domain in a single threat intelligence pulse, further corroborating its association with malicious activity. The domain is not currently listed in Google Safe Browsing, but its presence on PhishDestroy’s blocklist and low trust scores from Gridinsoft (29/100) and Scamadviser (46/100) underscore its elevated risk profile.

As of the latest assessment, torzondarknet.link has been taken offline, likely due to hosting provider or registrar enforcement. However, the domain remains registered, and the infrastructure could be reactivated or mirrored under a new address. Users who interacted with the site are advised to assume credential compromise, revoke any stored payment methods, and monitor accounts for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP, while security teams may investigate related infrastructure for broader campaign linkages.