torlinks[.]io

Analysis of the domain torlinks.io indicates active phishing infrastructure targeting users of the TorZon Market, a darknet marketplace. The domain was registered on February 23, 2026, through NiceNIC International Group Co., Limited, and currently resolves to the IP address 172.67.176.96, hosted on Cloudflare's network (AS13335) in the United States. The site returns an HTTP 200 status, suggesting operational functionality, and employs a Google Trust Services SSL certificate (WE1), which may lend an appearance of legitimacy to unsuspecting visitors. The page title explicitly references 'TorZon Market - torlinks,' aligning with known darknet marketplace phishing tactics. Detection data remains limited but indicative of malicious intent.

Gridinsoft assigns a trust score of 33 out of 100, reflecting low confidence in the domain's legitimacy. The domain appears on one security blocklist, specifically PhishDestroy, and is flagged by one of 93 security vendors on VirusTotal. While this detection rate is modest, it corroborates suspicions of phishing activity. The domain's infrastructure leverages WordPress, MySQL, PHP, Bootstrap, jQuery Migrate, jQuery, Google Analytics, and DataTables, a technology stack consistent with both legitimate and malicious sites but commonly exploited in phishing campaigns due to its ease of deployment. Defenders should prioritize blocking or monitoring this domain, particularly in environments where darknet market-related activity is prohibited or high-risk.

The use of Cloudflare nameservers (anahi.ns.cloudflare.com and rohin.ns.cloudflare.com) may complicate IP-based blocking, necessitating domain-level mitigations. Given the domain's recent registration and active status, continuous monitoring for changes in detection status or infrastructure is recommended. The exact nature of the phishing content remains unconfirmed, as no detailed forensic analysis of the site's payload has been conducted.