torzondrug[.]icu

The domain torzondrug.icu is identified as a phishing site specifically designed to impersonate the Torzon darknet marketplace. Analysis indicates this is a fraudulent access portal, presenting itself as an official link to Torzon Drugs with a fabricated future date (2026-02-12) in its page title. The domain is currently offline, but prior activity suggests it was actively used to deceive users seeking darknet market access, likely aiming to harvest credentials or distribute malware under the guise of legitimate marketplace entry. Infrastructure analysis reveals multiple high-risk indicators. The domain is flagged by 7 of 95 security vendors on VirusTotal, indicating malicious classification by a significant portion of the threat intelligence community. It resolves to the IP address 45.147.197.100 and employs DDoS-Guard for protection, a service frequently associated with illicit online operations. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar with a history of hosting suspicious domains. Additional technical data includes a Let's Encrypt SSL certificate, a single security blocklist presence, and a Gridinsoft trust score of 0 out of 100, reinforcing its classification as a high-risk entity. Current status shows the domain has been taken offline, likely due to enforcement actions or infrastructure changes. However, the threat remains relevant as similar domains may reappear under different names or TLDs. Users are strongly advised to verify darknet market access points exclusively through trusted sources and official communication channels. Network administrators should block the IP address 45.147.197.100 and monitor for domains registered via NiceNIC with similar naming patterns. The use of multi-factor authentication and endpoint protection is recommended to mitigate credential harvesting risks associated with such phishing campaigns.