Analysis of PhishPage v2.1 Infrastructure and Dark Web Phishing Operations
By Threat Intelligence Unit
Overview
Oasis Security identified a public IP address associated with a phishing site impersonating Torzon through the dark web intelligence service ARTHUR. Exposed services on that IP led to an externally accessible PhishPage v2.1 administrator panel used to manage multiple phishing onion sites.
The panel contained six phishing onion addresses impersonating Blackops, Dread, OnionMarket, Tenebris, and Torzon. PhishPage centrally manages those sites, collects credentials and related data, replaces cryptocurrency wallet addresses, delivers site events to Telegram, and automates account hijacking. This report also assesses the association between PhishPage and the developer known as NullFast.
Executive Summary
- A public IP associated with a Torzon phishing onion site led to an exposed PhishPage v2.1 panel on port 5173
- The panel managed six phishing onion addresses impersonating Blackops, Dread, OnionMarket, Tenebris, and Torzon
- Collected data included account credentials and, depending on the target, PGP keys, cryptocurrency information, orders, and exchange requests
- The Payment function can replace detected wallet addresses and QR codes with actor-controlled values
- Telegram notifications cover registration, login, exchange requests, high balances, orders, and XMR replacement
- Automation includes automatic password changes and, for Torzon, recovery-phrase collection during login
- PhishPage was updated from v1.0 to v2.1, removing most visible NullFast references. An association with NullFast's development of the framework is assessed as plausible, but the evidence does not show that NullFast operates the identified campaigns
Site Analysis
PhishPage v2.1 manages multiple phishing onion sites through a single interface. The impersonated services were:
| Target | Description |
|---|---|
| Blackops | Dark web marketplace trading drugs, digital goods, and illegal services |
| Dread | Dark web community forum covering market activity, scam warnings, cybercrime, privacy, and OPSEC |
| OnionMarket | Dark web marketplace trading illegal drug products |
| Tenebris | Reddit-style dark web forum similar to Dread |
| Torzon | Dark web marketplace trading drugs, digital goods, and fraud- and cybercrime-related products and services |
Each project used phishing onion addresses that fully or partially mimicked the corresponding legitimate service.
Figure 1. PhishPage v2.1 Projects panel
Infrastructure Analysis
ARTHUR identified the Torzon-related public IP twice.
- IP Address:
144.172.***.*** - Country: United States
Exposed services on the IP included:
| Port | Identified Activity |
|---|---|
5173 | PhishPage administrator panel externally accessible without authentication |
8453 | Phishing Tenebris onion address in the Set-Cookie domain |
8501 | Phishing Torzon onion address in the TLS certificate |
9001 | Historical Tor node observed on February 17, 2026 |
Figure 2. PhishPage panel hosted on the identified IP and port 5173
A Tor node was historically present on port 9001 of the same IP on February 17, 2026. No direct connection was confirmed between that node and the later PhishPage panel.
Identified Phishing Sites
Blackops
| Type | Address |
|---|---|
| Original | blackops3zlgfuq4dg4yrtxoe57u3sxfa34kqzbooqbovutleqhf3zqd.onion |
| Phishing | blackops5plbzcobwaqs2jy2b5mcot2pyvysevkxdrwrtgm3jgaipcyd.onion |
| Phishing | blackopslvxx25qutnc2yrjw4zmnx3osmuagrnxwfczuj6azstmwz5qd.onion |
On the original site, the CAPTCHA worked and login led to the main page. On the phishing site, the CAPTCHA failed during login.
Figure 3. Blackops Site Management showing phishing onion sites
Figure 4. Legitimate Blackops site after login
Figure 5. Phishing Blackops login with a failed CAPTCHA
Dread
| Type | Address |
|---|---|
| Original | dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion |
| Phishing | dreadto3asnacsujwhgyyici2fpdcd2lt2oejzy3kb2gliladdanzxad.onion |
The phishing site closely copied Dread's layout and posts, making visual distinction difficult.
Figure 6. Legitimate Dread interface
Figure 7. Phishing Dread interface
OnionMarket
| Type | Address |
|---|---|
| Original | tormarkeltajfxyjkot3jzjp7wktstu4k5v66oqye3ukujz6o3oqcgad.onion |
| Phishing | tormarket4tcremjsg4komhafrp23p2wjygogl66cfniwlbapohuhmid.onion |
The original site showed a CAPTCHA and phishing warning after login. The phishing site accepted original-service credentials without a separate registration step; its CAPTCHA displayed only a truncated onion address, but the site remained usable.
Figure 8. Legitimate OnionMarket URL verification
Figure 9. Phishing OnionMarket URL verification with an incomplete CAPTCHA
Tenebris
| Type | Address |
|---|---|
| Original | tenebrispoyfrcup4k24lciwrh4gc5735hmld4dweq7his7zh423opqd.onion |
| Phishing | tenebrisrsiaami7kn6gawo2ia2jc5d2vof6d4agxkuixauh4pzeywyd.onion |
| Clearnet | 144.172.***.***:8453 |
The phishing site reproduced Tenebris layout and content. Unlike the other clones, it was also reachable on the same PhishPage IP at port 8453 during analysis, before that access was blocked.
Figure 10. Legitimate Tenebris interface
Figure 11. Phishing Tenebris interface
Figure 12. Tenebris phishing site reachable on the identified IP and port 8453
Torzon
| Type | Address |
|---|---|
| Original | torzon4kv5swfazrziqvel2imhxcckc4otcvopiv5lnxzpqu4v4m5iyd.onion |
| Phishing | torzonnfsqftmkz5fmkla5fx4eg2ullxvelt6qutykj65s6me4q7iuqd.onion |
On the legitimate site, after a successful login, a warning on the main page alerted users to the existence of phishing sites. The phishing site displayed the same post-login content as the original. That included the original site's phishing-site warning, reproduced identically on the clone.
Figure 13. Legitimate Torzon main page after login, showing the phishing-site warning
Figure 14. Phishing Torzon site displaying the same post-login warning as the original
PhishPage v2.1 phishing operation
Exploitation Flow
The identified PhishPage infrastructure shows a centralized workflow for cloned onion services, credential and transaction collection, cryptocurrency payment manipulation, Telegram event delivery, and automated account hijacking.
Track A · Infrastructure
Phishing Infrastructure Exposure
- 01Torzon phishing infrastructure identifiedobservedARTHUR identified a public IP associated with an onion site impersonating Torzon.
- 02Exposed services analyzedobservedPhishPage was identified on port 5173, with related artifacts on ports 8453 and 8501.
- 03Administrator panel identifiedobservedThe PhishPage v2.1 interface centrally managed multiple phishing onion projects.
Centralized phishing infrastructure identifiedSix phishing onion addresses for five impersonated services were identified in the panel.
Track B · Collection
Credential and User-Data Collection
- 01Sites impersonate legitimate servicesobservedPhishing onion sites copy Blackops, Dread, OnionMarket, Tenebris, and Torzon.
- 02Credentials collectedobservedRegistration and login data can be viewed and exported from the Account menu.
- 03Additional data collectedobservedDepending on the target, PhishPage also collects PGP, cryptocurrency, order, and exchange data.
Centralized collection across phishing sitesThe panel contained account entries for all five impersonated services.
Track C · Payments
Cryptocurrency Address Replacement
- 01Payment information detectedobservedPhishPage identifies wallet addresses and related payment elements on targeted sites.
- 02Actor-controlled address configuredobservedThe Payment menu sets replacement wallet information per project.
- 03Original wallet replacedobservedOn the Dread phishing site, the original XMR address was replaced with the configured wallet.
Wallet replacement confirmedThe configured XMR address was observed on the phishing site in place of the original.
Track D · Automation
Notification and Account Hijacking
- 01Telegram event deliveryobservedRegistration, login, exchange, balance, order, and XMR-replacement events can be sent to Telegram.
- 02Account-stealing automationobservedAuto-Steal can change passwords for accounts above a BTC-balance threshold.
- 03Recovery phrase collectionobservedTorzon included an option to request mnemonics during login.
Automated post-collection activity supportedCollection, notification, and hijacking functions operate in the same framework.
Credential and User Information Collection
Credentials submitted on the phishing sites appear in the Account menu and can be exported as CSV. Where the target asks for extra data, PhishPage also collected PGP keys and cryptocurrency information. The Dashboard shows accounts and connections from the previous 24 hours.
Figure 15. Account menu with collected credentials and CSV export
Figure 16. Account entries including PGP, cryptocurrency, and cookie fields
Figure 17. Dashboard account and activity statistics
| Category | Phishing onion address | Entries |
|---|---|---|
| Blackops1 | blackops5plbzcobwaqs2jy2b5mcot2pyvysevkxdrwrtgm3jgaipcyd.onion | 149 |
| Blackops2 | blackopslvxx25qutnc2yrjw4zmnx3osmuagrnxwfczuj6azstmwz5qd.onion | 0 |
| Dread | dreadto3asnacsujwhgyyici2fpdcd2lt2oejzy3kb2gliladdanzxad.onion | 132 |
| OnionMarket | tormarket4tcremjsg4komhafrp23p2wjygogl66cfniwlbapohuhmid.onion | 126 |
| Tenebris | tenebrisrsiaami7kn6gawo2ia2jc5d2vof6d4agxkuixauh4pzeywyd.onion | 63 |
| Torzon | torzonnfsqftmkz5fmkla5fx4eg2ullxvelt6qutykj65s6me4q7iuqd.onion | 490 |
OnionMarket also stored 75 product-order records (order ID, username, product, seller, amount), totaling about NZ$11,377.03 (17.20872065 XMR).
Figure 18. OnionMarket order records
Torzon stored 22 exchange requests (17 BTC, 5 XMR), totaling 0.0410618 BTC and 1.7608827 XMR.
Figure 19. Torzon exchange requests
Cryptocurrency Wallet Address Replacement
The Payment menu can replace detected wallet addresses and QR codes with values set by the operator. For Monero-only targets such as Dread and Tenebris, only the XMR address can be changed.
Figure 20. Blackops Payment menu with replacement BTC and XMR addresses
Figure 21. Dread Payment menu limited to XMR replacement
The original Dread XMR address was:
8B9jK4hdV6BPZtPz1bN24jLm84vhwwXYnDDff4cHSG7RWDPdaJ5SKrYe2NCvvBL1MyTA4Dh6PuG6C21gXcJu7VDtFC66m5Y
On the phishing site it was replaced with the address configured in PhishPage:
87338W5b8nXMHXML36pkn8XxH8MWdGkvedKkVruu5rG52QoLMRyfxVk6FsgKGbixvzAe6SUvCVvAzHEvYQe5vsq8JaGCsif
Figure 22. Original XMR address on legitimate Dread
Figure 23. Replaced XMR address on the Dread phishing site
Telegram-Based Event Delivery
Operators can send site events to Telegram using a Bot Token and Chat or Channel ID. Supported events include registration, login, exchange requests, high balances, orders, and XMR address replacement.
Figure 24. Telegram bot token and Chat/Channel ID configuration
Each project used a different BotFather-issued bot token, but all used the same Chat/Channel ID 896315828. A SangMata lookup of that ID recorded the name CCDork2021 on July 10, 2021, with no username.
Figure 25. SangMata history for Telegram ID 896315828
Automated Account Hijacking Functions
Auto-Steal Accounts changes passwords when a BTC balance exceeds a configured threshold. A separate option targets shop accounts. Torzon also has Collect mnemonic on login, which can prompt for a recovery phrase after username and password.
Figure 26. Auto-Steal Accounts settings
Figure 27. Torzon option to collect a recovery phrase on login
Additional PhishPage Functions
FAQ AI answers operator questions on site creation, XMR replacement, Telegram alerts, captured data, on-site text changes, and Auto-Steal.
Figure 28. FAQ AI in PhishPage v2.1
The Onion Generator creates onion addresses by prefix, count, and thread count, and shows CPU, memory, domain count, and uptime. At analysis time, six addresses were attached to Tenebris, OnionMarket, Blackops, Dread, and Torzon.
Figure 29. Onion Generator
Figure 30. Six onion addresses linked to the identified projects
PhishPage v1.0 and v2.1
During analysis the panel was updated from v1.0 to v2.1. Core functions were unchanged; the visible differences were UI, FAQ AI copy, and developer attribution.
v1.0 branded the product as "PhishPage by @NullFast" and directed technical support to @NullFast. v2.1 replaced that with "PhishPage v2.1" and removed most identifying references. The change is consistent with ongoing maintenance of a service-type product, and with an effort to reduce developer-identifying information.
Figure 31. PhishPage v1.0 Onion Generator branded by @NullFast
Figure 32. PhishPage v1.0 branding: "by @NullFast"
Figure 33. v1.0 FAQ AI directing support to @NullFast
Figure 34. FAQ AI in PhishPage v2.1 after NullFast branding was removed
Assessment of Potential Association with NullFast
ARTHUR-collected posts show NullFast advertising full-stack work including live panels, cryptocurrency projects, reverse-proxy sites, site cloning, Telegram bots, and automation. Those capabilities overlap with PhishPage. A July 19, 2026 comment on the same thread said commissions were still being accepted.
Figure 35. NullFast posts identified through ARTHUR
Figure 36. NullFast post advertising live panels, reverse-proxy sites, and site cloning
Figure 37. July 19, 2026 comment stating commissions were still accepted
Telegram @nullfast remained reachable, using the name "NULL FAST CODER", bio "Dell," and status "last seen within a month."
Figure 38. Telegram account @nullfast
Together, several indicators support a plausible association between NullFast and PhishPage development:
- The "by @NullFast" attribution in PhishPage v1.0
- Overlap between advertised skills and PhishPage functions
- Public activity through July 2026
- Recent activity on the identified Telegram account
The evidence does not show that NullFast currently operates this infrastructure or the individual phishing campaigns.
Conclusion
The identified PhishPage v2.1 panel centrally managed phishing clones of multiple dark web services. Beyond credential collection, it supported order and exchange-data capture, cryptocurrency wallet replacement, Telegram alerting, onion address generation, and automated account hijacking.
The update from v1.0 to v2.1, continued maintenance, and removal of NullFast branding are consistent with a service-type product rather than a one-off kit. The v1.0 attribution and overlap with development services advertised by NullFast support an assessed association with the framework's development. The available evidence does not establish that NullFast currently operates this infrastructure or is directly responsible for the individual phishing campaigns.