torzon-onion-link[.]info

Analysis of torzon-onion-link.info indicates a high-risk phishing domain actively targeting users of darknet market services. The domain, registered on February 21, 2026, through NiceNIC International Group Co., Limited, resolves to IP address 172.67.217.241 and is currently flagged by 24 threat intelligence pulses in AlienVault OTX. Security blocklists PhishDestroy and BLP-Malware have already classified this domain as malicious, with a Gridinsoft trust score of 0/100 reinforcing its fraudulent nature. The page title explicitly references 'Torzon Market Link - Access Torzon Darknet Market & Official Onion Link,' suggesting an attempt to deceive users seeking legitimate darknet market access. Infrastructure analysis reveals the use of Cloudflare services, including HTTP/3 and Cloudflare Browser Insights, alongside frontend technologies such as Tailwind CSS and Vue.js. While Cloudflare’s infrastructure may obscure some network-level details, the SSL certificate issued by Google Trust Services does not mitigate the domain’s malicious intent. Four security vendors have flagged this domain in VirusTotal scans, though the specific detection signatures remain unconfirmed. The domain’s creation in early 2026, combined with its presence on multiple blocklists and threat intelligence feeds, aligns with patterns observed in phishing campaigns targeting darknet market users. Defenders should treat this domain as an active threat, block resolution at the DNS level, and monitor for related indicators of compromise in network logs. The exact content and functionality of the site remain unanalyzed, but the available evidence strongly supports its classification as a phishing operation.