Is torzon-onion.uk safe?
http://torzon-onion.uk/
Coveragestrong3 of 4 applicable core capabilities
Clearnet "TORZON Darknet Market" portal flagged as a crypto-drainer phishing domain
torzon-onion.uk presents itself as a clearnet gateway to the "TORZON" darknet market, offering "Sign In" and "Mirror" links that point to an .onion address. Independent security research identifies the domain as an active crypto-drainer phishing operation that mimics Tor-based onion services to trick visitors into connecting cryptocurrency wallets, after which funds can be transferred without authorization. The site's own copy confirms it is a clearnet mirror page rather than the market itself, and the domain is under a year old. Because the core function is wallet-draining deception rather than a legitimate service, the score sits in the Dangerous band.
Be the first to review torzon-onion.uk
Lost money to torzon-onion.uk? Warn others
Loading saved screenshot
Preparing the saved page preview.
Where this site sits
- Dangerous1–20
- High Risk21–44
- Moderate Risk45–69
- Low Risk70–84
- Safe85–100
The score combines saved evidence strength and analysis quality. Coverage is reported separately.
01 · Investigation Brief
Investigation Brief
torzon-onion.uk presents itself as a clearnet gateway to the "TORZON" darknet market, offering "Sign In" and "Mirror" links that point to an .onion address. Independent security research identifies the domain as an active crypto-drainer phishing operation that mimics Tor-based onion services to trick visitors into connecting cryptocurrency wallets, after which funds can be transferred without authorization. The site's own copy confirms it is a clearnet mirror page rather than the market itself, and the domain is under a year old. Because the core function is wallet-draining deception rather than a legitimate service, the score sits in the Dangerous band.
Independent research identifies an active crypto-drainer phishing domain
Security researchers identify torzon-onion.uk as an active crypto drainer phishing domain designed to deceive users into connecting cryptocurrency wallets under the guise of a Tor-based onion service. The same research warns that the domain mimics legitimate .onion services to exploit trust in privacy-focused platforms, and that any interaction with the site may result in unauthorized cryptocurrency transfers from connected wallets.
A saved antivirus observation also recorded an adverse result from one independent antivirus family, which is consistent with the phishing classification even though the detection data is stale and should be treated as corroborating rather than definitive.
The site's own pages confirm a clearnet mirror funnel to an .onion address
The page describes "TORZON" as a marketplace of shops selling goods "located in the shady part of the Internet, inside the Tor network," and notes that items are not delivered in the usual way. The footer states that "TORZON DARKNET MARKET provides links to any official store mirror page that can be seen without the Tor browser," which confirms the site positions itself as a clearnet access point rather than the market itself.
The page presents "Go to TORZON," "Mirror Torzon," and "Torzon Sign In" controls that route visitors toward the same .onion destination, creating a sign-in and mirror funnel that matches the wallet-connection deception described by researchers.
Clean transport checks do not offset the operator-level deception
The browser threat feed returned no threat warning and the saved TLS check found a valid encrypted connection, so the site is not currently blocked at the browser level and traffic is encrypted. Those are transport-level facts only; they say nothing about whether the operator is honest.
The registrable domain is only 331 days old, which is consistent with a recently stood-up phishing operation rather than an established service. The operator is not disclosed on the reviewed pages, and the site's purpose is to funnel visitors toward a wallet-connection flow that researchers describe as a drainer.
Why the score is 18
One public warning on a scam-warning or security site: "PhishDestroy identifies torzon-onion[.]uk as an active crypto drainer phishing domain designed to deceive users into connecting cryptocurrency wallets under…". Coverage remains separate so missing sources cannot be mistaken for clean results.
02 · Security Evidence
Security evidence
Antivirus Engines
2/ 92
detectionsSaved analysis from October 2, 2026 - stale
2 engines flagged this URL
Every saved adverse engine is listed below. The full provider matrix remains available for audit.
- Malicious
- 1
- Suspicious
- 1
- Total
- 92
| Engine | Finding |
|---|---|
| Chong Lua DaoMalicious | malicious |
| GridinsoftSuspicious | suspicious |
All 92 engine results
- Chong Lua Dao - Malicious
- Gridinsoft - Suspicious
- 0xSI_f33d - Unrated
- Abusix - Clean
- Acronis - Clean
- ADMINUSLabs - Clean
- AILabs (MONITORAPP) - Clean
- AlienVault - Clean
- alphaMountain.ai - Unrated
- AlphaSOC - Unrated
- Antiy-AVL - Clean
- ArcSight Threat Intelligence - Unrated
- AutoShun - Unrated
- Bfore.Ai PreCrime - Unrated
- BitDefender - Clean
- Bkav - Unrated
- BlockList - Clean
- Blueliv - Clean
- Certego - Clean
- ChainPatrol - Unrated
- CINS Army - Clean
- CRDF - Clean
- Criminal IP - Unrated
- CSIS Security Group - Unrated
- CTX AI - Clean
- Cyan - Unrated
- Cyble - Clean
- CyRadar - Clean
- desenmascara.me - Clean
- DNS8 - Unrated
- Dr.Web - Clean
- EmergingThreats - Clean
- Emsisoft - Clean
- Ermes - Unrated
- ESET - Clean
- ESTsecurity - Clean
- Forcepoint ThreatSeeker - Unrated
- Fortinet - Clean
- Fortra - Unrated
- G-Data - Clean
- GCP Abuse Intelligence - Unrated
- Google Safe Browsing - Clean
- GreenSnow - Clean
- GreyNoise - Unrated
- Guardpot - Unrated
- Heimdal Security - Clean
- Hunt.io Intelligence - Unrated
- IPsum - Clean
- Juniper Networks - Clean
- K7AntiVirus - Unrated
- Kaspersky - Clean
- LevelBlue - Clean
- Lionic - Clean
- Lumu - Unrated
- Malwared - Clean
- MalwarePatrol - Clean
- MalwareURL - Unrated
- Mimecast - Unrated
- Netcraft - Unrated
- OpenPhish - Clean
- PhishFort - Unrated
- Phishing Database - Clean
- Phishtank - Clean
- PREBYTES - Clean
- PrecisionSec - Unrated
- Quick Heal - Clean
- Quttera - Clean
- Rising - Clean
- SafeToOpen - Unrated
- Sangfor - Clean
- Sansec eComscan - Unrated
- Scantitan - Clean
- SCUMWARE.org - Clean
- Seclookup - Clean
- Snort IP sample list - Unrated
- SOCRadar - Unrated
- Sophos - Clean
- StopForumSpam - Clean
- Sucuri SiteCheck - Clean
- Synthient - Unrated
- ThreatHive - Clean
- URLhaus - Clean
- URLQuery - Unrated
- Viettel Threat Intelligence - Clean
- VIPRE - Unrated
- ViriBack - Clean
- VX Vault - Clean
- Webroot - Clean
- Xcitium Verdict Cloud - Clean
- Yandex Safebrowsing - Clean
- ZeroCERT - Clean
- ZeroFox - Unrated
Security Scans
Checked against the browser threat feeds available to this scan — no hit.
What we observed
Loading saved screenshot
Preparing the saved page preview.
Visual context from the captured page
TORZON Darknet Market
What the captured page showed
1 observation- 01
TORZON Darknet Market
03 · Investigation Story
Investigation story
What the site claims
Visit the official website Torzon Onion Market
What we observed
The page content was captured and checked alongside 58 antivirus results.
What independent research found
2 external findings were saved and compared with the page evidence.
What remains unverified
1 of the 4 applicable core capabilities did not complete, so those gaps remain visible in the coverage ledger.
What kind of site and risk is this?
Threat category
Phishing & Impersonation
Service and business model
Login Portal
Observed behavior
Evidence behind this classification
- 01One public warning on a scam-warning or security site: "PhishDestroy identifies torzon-onion[.]uk as an active crypto drainer phishing domain designed to deceive users into connecting cryptocurrency wallets under…"
- 021 independent antivirus family reported an adverse result. This comes from a saved antivirus observation rather than a new submission, so treat the detection as real but confirm the timing.
- 03The registrable domain is 331 days old, consistent with a recently created operation rather than an established service.
What this means for you
What happens when a visitor follows the sign-in or mirror path
A visitor who clicks "Go to TORZON" or "Torzon Sign In" is routed toward the .onion destination the site promotes, which is the point at which the wallet-connection deception described by researchers would occur.
How the observed mechanism works
The evidence-backed path
Each stage below is preserved from the grounded analysis and linked to saved evidence.
Researchers state that any interaction with this site may result in unauthorized cryptocurrency transfers from connected wallets, meaning the exposure is direct financial loss rather than a mere credential-harvesting attempt.
Do not connect a cryptocurrency wallet, enter credentials, or follow the .onion links promoted on torzon-onion.uk. The domain is identified by independent security research as an active crypto-drainer phishing site that mimics a Tor onion service, and the site's own copy confirms it is a clearnet mirror funnel rather than the market it claims to represent. If you have already connected a wallet, revoke token approvals and move remaining funds to a fresh wallet immediately.
Web research findings
Independent findings for torzon-onion.uk, including public complaints, named review sources, registration records, and look-alike-domain evidence. A missing result is shown as unverified, never converted into a clean bill of health.
- PhishDestroyopen
"PhishDestroy identifies torzon-onion[.]uk as an active crypto drainer phishing domain designed to deceive users into connecting cryptocurrency wallets under the guise of a Tor-based onion service."
- PhishDestroyopen
"Security researchers warn that this domain mimics legitimate .onion services to exploit trust in privacy-focused platforms. Any interaction with this site may result in unauthorized cryptocurrency transfers from connected wallets"
Reputation Sources
How this domain rates across independent threat-intelligence and blocklist providers.
04 · Domain & Infrastructure
Domain & infrastructure
The plumbing behind the site — who registered it, how it’s encrypted, where it’s hosted, and where it links out. A valid certificate or a calm server doesn’t mean the business is honest — scam sites pass these checks too. Use this to corroborate the verdict, not to overturn it.
Infrastructure map
How the saved page connected to the wider web.
- Domaintorzon-onion.uk
- Redirects totorzon-onion.uk
- Hosted byNamecheap, Inc.
- Referencesfonts.googleapis.com · s.w.org
Domain Timeline
- Nov 25, 2025Domain registered
First appeared in WHOIS records — 11 months old when this review was saved.
- Oct 22, 2026Saved security review — Rated Dangerous
The completed checks from this saved scan are detailed above.
Contact Verification
Saved contact details can help identify the operator. Their presence supports traceability; it does not prove the business is trustworthy.
- Contact email on the site's own domain (support@torzon-onion.uk).
Domain & Encryption
Redirect Chain
- 1301http://torzon-onion.uk/
- 2200https://torzon-onion.uk/
Server Reputation
Referenced Domains
Outbound domains this page links to or loads resources from. Each links to its own security scan.
05 · Evidence Ledger
Evidence ledger
- Antiviruspartial
- Browser threat feedcomplete
- Page contentcomplete
- Analysiscomplete
- Visual evidencecomplete
The conclusion is supported by the evidence saved with this report.
Technical threat
suspiciousMalware, phishing, credential theft and hostile infrastructure.
The site's own footer states it provides links to official store mirror pages viewable without the Tor browser, and its controls route visitors to an .onion address for sign-in and mirror access. · Similar to a catalog of retailers, "TORZON" is a marketplace of shops selling goods for certain purposes. located in the shady part of the Internet, inside the Tor network. It was incorrectly referred to as "torzonbot" although its actual name was "TORZON." The items are not delivered in the usual way because this is a bookmark store. Rather than a courier, you will receive an address and an explanation of where to pick up the goods. Support and legal help are available 24/7 for both buyers and sellers. Tor is also suitable because the Torzon Darknet website uses encrypted connections, such as a VPN or proxy, and sells illicit drugs.
Operator / customer risk
suspiciousComplaints, withdrawals, business conduct and commercial traps.
One public warning on a scam-warning or security site: "PhishDestroy identifies torzon-onion[.]uk as an active crypto drainer phishing domain designed to deceive users into connecting cryptocurrency wallets under…"
Source coverage and freshness
Status shows whether usable evidence was saved; finding shows what that evidence observed.
| Source | Result | Completion | Finding | Freshness |
|---|---|---|---|---|
| Antivirus | 2 of 92 engines flagged | Limited | Adverse | stale fallback · analysed Oct 2, 2026 |
| Browser protection | No browser threat-list match | Completed | No adverse finding | this scan · Oct 22, 2026 |
| Page content | Page fetched · HTTP 200 | Completed | No adverse finding | this scan · Oct 22, 2026 |
| Visual evidence | 1 visible observation saved with the page capture | Completed | No adverse finding | this scan · Oct 22, 2026 |
| Independent research | 2 independent findings were saved | Completed | Adverse | this scan · Oct 22, 2026 |
- Antivirus
- Result2 of 92 engines flagged
- CompletionLimited
- FindingAdverse
- Freshnessstale fallback · analysed Oct 2, 2026
- Browser protection
- ResultNo browser threat-list match
- CompletionCompleted
- FindingNo adverse finding
- Freshnessthis scan · Oct 22, 2026
- Page content
- ResultPage fetched · HTTP 200
- CompletionCompleted
- FindingNo adverse finding
- Freshnessthis scan · Oct 22, 2026
- Visual evidence
- Result1 visible observation saved with the page capture
- CompletionCompleted
- FindingNo adverse finding
- Freshnessthis scan · Oct 22, 2026
- Independent research
- Result2 independent findings were saved
- CompletionCompleted
- FindingAdverse
- Freshnessthis scan · Oct 22, 2026
07 · Safety FAQ
Safety FAQ
Common questions, answered directly from the scan data above — so the answers reflect the saved verdict and evidence in this report.
Is torzon-onion.uk a scam or a legit website?
Is torzon-onion.uk safe to use?
What should I do if I already gave my details to torzon-onion.uk?
Can I get my money back from torzon-onion.uk?
Did torzon-onion.uk steal my password or personal information?
How do I report torzon-onion.uk?
Why does torzon-onion.uk look legitimate if it's a scam?
Has torzon-onion.uk been flagged by antivirus engines?
Is torzon-onion.uk on any phishing or malware blacklists?
How old is the torzon-onion.uk domain?
Where is torzon-onion.uk hosted?
How often is the torzon-onion.uk report updated?
08 · Final Verdict
Final verdict
Clearnet "TORZON Darknet Market" portal flagged as a crypto-drainer phishing domain
torzon-onion.uk presents itself as a clearnet gateway to the "TORZON" darknet market, offering "Sign In" and "Mirror" links that point to an .onion address. Independent security research identifies the domain as an active crypto-drainer phishing operation that mimics Tor-based onion services to trick visitors into connecting cryptocurrency wallets, after which funds can be transferred without authorization. The site's own copy confirms it is a clearnet mirror page rather than the market itself, and the domain is under a year old. Because the core function is wallet-draining deception rather than a legitimate service, the score sits in the Dangerous band.
09 · Community