market[.]torzn[.]info

Analysis of market.torzn.info confirms its classification as a phishing domain targeting users of darknet market services. The domain, registered on February 23, 2026, through Dynadot LLC, presents itself under the page title 'Torzon Darknet - Official Info,' suggesting an attempt to impersonate or mislead users seeking access to Torzon-related platforms. As of July 24, 2026, the domain resolves to a Cloudflare-hosted IPv6 address (2606:4700:3032::ac43:a427) within AS13335, with nameservers cody.ns.cloudflare.com and stevie.ns.cloudflare.com, indicating reliance on Cloudflare's infrastructure for anonymity and resilience. The site is currently offline, returning an HTTP 503 status, though this may reflect temporary takedown efforts or operational adjustments by the threat actor.

Detection data is limited but indicative: one security vendor on VirusTotal has flagged the domain, and it appears on a single blocklist (PhishDestroy). The SSL certificate, issued by Google Trust Services (WE1), does not provide additional malicious context, as Cloudflare routinely provisions such certificates for customer domains. Gridinsoft's trust score of 0/100 further supports the domain's high-risk classification. No evidence of a specific phishing kit or targeted brand beyond the 'Torzon' reference in the page title has been confirmed, and the exact content or payload of the site remains unanalyzed due to its offline status.

Defenders should treat this domain as a confirmed phishing threat, particularly for users seeking darknet market access. Blocklist integration at the DNS or network level is recommended, along with monitoring for re-emergence under the same or similar infrastructure. Given the use of Cloudflare, additional scrutiny of domains sharing the same nameservers or IP range may uncover related malicious activity. No indicators suggest this domain is part of a broader campaign beyond its current classification as a darknet market phishing site.