torzonqgq7icutzxe4pjpsftwk2tuj5lnbj2i4tmnwwuak6kurvpp4yd[.]icu

This domain, torzonqgq7icutzxe4pjpsftwk2tuj5lnbj2i4tmnwwuak6kurvpp4yd.icu, is identified as a generic phishing threat specifically targeting users of the TorZon darknet marketplace. Analysis indicates the domain hosted a fake login portal titled 'TorZon Access Queue,' designed to harvest credentials from unsuspecting users attempting to access the legitimate TorZon platform. The domain is currently offline, though its infrastructure and historical activity remain relevant for threat correlation and defensive measures. Infrastructure analysis reveals the domain was registered on June 10, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolved to the IP address 188.114.97.3, which is part of a network known for hosting malicious content. The domain was flagged by 6 of 95 security vendors on VirusTotal, indicating moderate detection but elevated concern due to its targeted nature. It appeared on one security blocklist and was assigned a trust score of 5 out of 100 by Gridinsoft, further corroborating its malicious classification. The SSL certificate was issued by Google Trust Services, a common tactic to lend false legitimacy to phishing sites. Technologies detected include Cloudflare and HTTP/3, suggesting the use of modern, evasive hosting practices to obscure the true origin of the threat. The domain's current status is offline, though its historical indicators remain critical for threat hunting and defensive posturing. Organizations and individuals are advised to block the domain and its associated IP address (188.114.97.3) at the network perimeter. Security teams should monitor for any attempts to reuse the domain or its infrastructure, particularly in credential phishing campaigns targeting darknet market users. End-users should be educated on recognizing fake login portals, especially those impersonating high-value platforms like TorZon. Additionally, security controls should be configured to alert on any connections to newly registered domains with similar characteristics, such as those using Cloudflare or HTTP/3, to mitigate future risks from evolving phishing tactics.