torzonmarketopen[.]com

This domain, torzonmarketopen.com, is flagged as a high-risk phishing site targeting users of the Torzon Market platform. Registered on February 21, 2026, through NiceNIC International Group Co., Limited, the domain presents itself as an 'official mirror' of Torzon Market, as indicated by its page title: 'Torzon Market — Verified Official Mirror & Active Onion URL [2025]'. The site remains active as of July 13, 2026, and resolves to IP address 104.21.25.26, hosted on Cloudflare's infrastructure (AS13335). It employs Cloudflare nameservers (paris.ns.cloudflare.com, vasilii.ns.cloudflare.com) and uses HTTP/3, with a valid SSL certificate issued by Google Trust Services (WE1). Analysis indicates the domain is designed to mimic legitimate Torzon Market access points, likely to harvest credentials or distribute malicious payloads. It has been blocked by one security vendor (PhishDestroy) and assigned a trust score of 0/100 by Gridinsoft. VirusTotal reports a single detection among 93 security vendors, suggesting limited but existing recognition of its malicious nature. The HTTP status code 200 confirms the site is operational and serving content. Defenders should treat this domain as an active threat. Blocking the domain and its resolved IP (104.21.25.26) at the network level is recommended. Monitoring for connections to this IP or domain may help identify compromised endpoints. Given the use of Cloudflare, additional scrutiny of traffic to Cloudflare-hosted domains with similar naming patterns (e.g., 'torzon' or 'market' in the domain) may be warranted. The exact content and functionality of the site remain unconfirmed, but the page title and infrastructure suggest credential phishing or distribution of malicious links as likely objectives.