torzon-darknet[.]shop

torzon-darknet.shop was registered on October 18, 2025 through Namecheap, Inc. The domain resolves to the IPv4 address 45.147.197.100 and is currently listed on the PhishDestroy blocklist, which is the only public blocklist observed. VirusTotal has scanned the domain and 5 out of 91 security vendors returned a positive detection, indicating a non‑trivial malicious presence. The threat is classified as generic phishing and is marked as active with an elevated risk rating as of the report date, July 29, 2026. Analysis of the available infrastructure shows a single point of hosting; no additional IPs or CDN services have been identified.

The registrar information does not conceal the owner, and the domain age of just over one year aligns with typical phishing campaign lifecycles. Absence of public SSL certificate details, HTTP status codes, Safe Browsing verdicts, or page‑title metadata limits the depth of technical profiling. Consequently, the exact phishing campaign payload, targeted brand, or lure technique remains unknown. Defenders should prioritize immediate blocking of torzon-darknet.shop at the DNS and proxy layers, and add the resolving IP 45.147.197.100 to network‑level deny lists.

Continuous monitoring of the IP for any shift in hosting provider or additional sub‑domains is advised. Given the partial detection by VirusTotal, security solutions that integrate multi‑engine verdicts should be configured to flag any request to this domain. Inclusion of the domain in internal threat intel feeds and sharing with industry blocklist operators will help broaden the collective defense surface. Organizations with sensitive credential portals should reinforce user awareness training, emphasizing verification of URL authenticity, even for domains that appear superficially plausible.