torzonmarket[.]xin

PhishDestroy has flagged the domain torzonmarket.xin as a generic phishing threat that impersonates the TorZon Market darknet marketplace. The page title 'TorZon Market — Global Ops Desk & Live Onion Monitor (2026)' suggests it is designed to lure users into believing it is a legitimate onion service, but it operates on the clearnet to harvest credentials or deploy crypto drainers. This domain was created on April 22, 2026, and is registered through Eranet International Limited, a registrar often associated with low-reputation domains.

Technical indicators include a VirusTotal score of 0 out of 95 detections, meaning it has not yet been flagged by security vendors. The domain resolves to IP address 188.114.96.3, which is associated with Cloudflare, and its SSL certificate is issued by Google Trust Services (WE1). It appears on one security blocklist and is listed in one AlienVault OTX pulse. Notably, Google Safe Browsing (GSB) status is not mentioned in the data, but the domain is currently offline.

The domain is offline as per the latest check, but the risk remains that it could be reactivated or that similar domains may appear. PhishDestroy recommends blocking this domain at the network level and monitoring for any new registrations mimicking TorZon Market. Users should be warned that legitimate darknet markets do not use clearnet domains or require login through a web browser without Tor. Ongoing vigilance is advised as this threat has zero detections and may evade initial security filters.