Phishing Against Torzon, Nexus, and North Brands
Clone domains and altered onions remain the top loss path in 2026. Verification habits that cut most incidents.
Phishing volume against major brands stayed elevated through 2026. Torzon and Nexus take the heaviest clone traffic; We The North sees regional lookalikes. The product is always the same: passwords, deposits, seeds.
What changed vs older years
Clones now match spacing, favicons, and login copy. The remaining signal is the address itself — and personal anti-phishing phrases on markets that offer them.
Hard rules
- Baseline only from Markets
- No shortened links, no QR from chat
- No seed phrases on any market UI
- Urgency copy (“funds lock in 10 minutes”) = hostile
Deep dive: June Torzon spike, clearnet hub risks.