Six clearnet domains are currently serving fake TorZon .onion addresses. None of them are operated by TorZon's team. All of them steal credentials.
The confirmed fake domains
Each domain below was tested by comparing the .onion addresses it publishes against TorZon's PGP-signed mirror list. In every case, the addresses did not match. The domains serve fabricated .onion links that redirect to phishing clones of TorZon's login page.
For verified TorZon links, see the TorZon Market page with PGP-signed mirrors.
How these phishing sites operate
The operation follows a pattern we see across all market-targeting phishing campaigns. The attacker registers a clearnet domain with "torzon" in the name, builds a page that looks like a legitimate reference site, and publishes fake .onion addresses. The pages are optimized for search engines — some rank on the first page of Google for queries like "torzon market link" or "torzon url."
The fake .onion addresses point to phishing clones of TorZon's login page. These clones are near-perfect copies. The login form works, the layout matches, the colors are right. The difference is invisible to a casual user: when you enter your username and password, the credentials are captured by the attacker.
Some of these phishing operations go further. After capturing your login, they proxy your session to the real TorZon, so you see your real account, your real balance, your real messages. But the deposit addresses displayed on the phishing proxy have been swapped — any cryptocurrency you deposit goes to the attacker's wallet, not to TorZon's escrow.
Domain-by-domain breakdown
torzon-darknetmarket.com — Registered in late 2025. Publishes a list of three .onion addresses, none of which match TorZon's signed mirrors. The site includes a fake "last updated" timestamp that changes daily to appear current. It ranks in Google search results for several TorZon-related queries.
torzon-market.club — One of the oldest active phishing sites targeting TorZon. Uses aggressive SEO, including keyword-stuffed blog posts and fake user testimonials. The .onion addresses on this site have changed at least twice, suggesting the operator rotates phishing infrastructure.
torzon-market-link.net — Appears to be operated by the same group running torzon-market.club (similar page layout, shared tracking scripts). Lists two .onion addresses that lead to the same phishing clone.
torzon.news — Styled as a "news" site about TorZon, with fabricated articles about market updates. The .onion addresses embedded in the articles are phishing links. The domain was registered in early 2026.
torzonmarket.org — Minimal site with just the fake links and a generic description. No blog content. Appears to target users who type "torzon market" directly into a browser's address bar, which resolves to a search that returns this domain.
torzon-links.com — Presents itself as a "link aggregator" listing multiple markets. The TorZon links are fake; links for other markets may also be fake but we have not independently verified all of them.
How to verify real TorZon links
TorZon publishes its official .onion addresses inside a PGP-signed message. You can verify this message using TorZon's public PGP key. If the signature is valid, the addresses inside are authentic. If the signature fails or is absent, the addresses are unverified and should not be used.
You can also check your anti-phishing phrase. If you registered on TorZon and set a security phrase, it should appear on the login page every time you visit. If the phrase is wrong or missing, you are on a phishing clone.
What to do if you used one of these sites
If you entered credentials on any of the domains listed above, your TorZon account is compromised. Take these steps immediately:
Change your password immediately. Use a unique, randomly generated password from a password manager like KeePassXC.
3
Enable two-factor authentication if you haven't already.
4
Check your transaction history. If funds were deposited to an address from the phishing site, those funds are gone — the deposit went to the attacker's wallet.
5
Update your PGP key if you uploaded one to TorZon. The attacker may have access to messages encrypted with the old key.
TorZon scam questions
No. torzon-market.club is a confirmed phishing site. TorZon Market does not operate any clearnet website. TorZon exists only as .onion addresses inside the Tor network. Any .com, .club, .net, or .org domain with "torzon" in the name is fake.
Phishing sites use standard search engine optimization techniques: keyword-targeted content, backlinks, and "freshness" signals like fake update timestamps. Google's algorithms do not evaluate whether a site is serving fake darknet market links — they rank based on relevance and authority signals, which phishing operators deliberately manipulate.
You can report phishing domains to Google through their Safe Browsing report form, to the domain registrar through a WHOIS lookup and abuse contact, and to the Dread community. Some domains get taken down through registrar abuse reports, but new ones typically appear within days.
No. TorZon does not operate any clearnet website. The market is accessible only through .onion addresses via the Tor network. Any clearnet domain claiming to be TorZon or to represent TorZon is either a phishing site or a third-party reference site.