TorZon Vendor Ratings Scam: How Fake Reviews Poison the Market

Security researchers announced on June 7, 2026 that a coordinated fake‑review operation on the TorZon darknet marketplace has inflated the ratings of at least 15 vendors, affecting roughly 30 percent of the platform’s top‑selling listings. The campaign, which ran from November 2025 through February 2026, used automated scripts to post hundreds of fabricated buyer testimonials, misleading shoppers and distorting market prices.

Key Findings

The investigative team identified more than 1,200 suspicious review entries across TorZon’s rating system. Analysis of posting timestamps showed clusters of activity that correspond to known bot‑operated IP ranges. The fake reviews praised products ranging from stolen credit‑card data and remote‑desktop access tools to PayPal cookie converters and BIN checkers.

Researchers confirmed that the majority of the fabricated posts originated from three separate accounts, each linked to a vendor that sells high‑volume data exfiltration tools. The accounts used the same phrasing pattern – “Fast delivery, works perfectly,” – and were posted within minutes of each other, a hallmark of scripted activity.

TorZon’s moderation logs, accessed through a leaked admin panel, indicate that the platform’s automated rating filters failed to flag the majority of these entries. Only 12 percent of the fake reviews were removed before the researchers disclosed their findings.

Background on TorZon

TorZon, established in early 2022, has become one of the largest marketplaces for cybercrime tools, offering everything from stealer logs to personal‑information packages. The platform’s user base has grown steadily, with transaction volume rising by 45 percent over the past year, according to blockchain‑payment analytics.

The marketplace relies heavily on a reputation system where buyer feedback determines vendor visibility. High‑rated sellers enjoy preferential placement in search results and can command premium prices. This trust model makes the rating system a critical component of TorZon’s economic ecosystem.

Expert and Community Reaction

“The integrity of vendor ratings is the backbone of any darknet market,” said Dr. Elena Kovacs, a cybersecurity analyst at the Institute for Digital Threat Research. “When that trust is compromised, buyers are forced to rely on external verification methods, which slows transactions and can push users toward less regulated forums.”

Within the TorZon community, several high‑profile vendors issued statements denying involvement in the scheme. A prominent vendor, known by the handle “ZeroDayX,” posted a brief notice on the forum, asserting that “all reviews are genuine and reflect real customer experiences.”

Conversely, some buyers expressed frustration on related forums, reporting that purchased data sets failed to work as advertised, a symptom they now attribute to the inflated ratings.

Implications and What to Watch For

The discovery underscores the vulnerability of reputation‑based economies in illicit markets. If buyers cannot rely on posted reviews, they may turn to escrow services, third‑party verification sites, or shift to alternative marketplaces that claim stricter moderation.

Industry observers note that the fake‑review technique mirrors tactics used on mainstream e‑commerce platforms, suggesting a convergence of criminal and legitimate market manipulation methods. Ongoing monitoring of review patterns on TorZon and similar sites will be essential to detect future campaigns.

Authorities have not yet announced any arrests linked to the scam, but the public disclosure may prompt law‑enforcement agencies to prioritize investigations into the three accounts identified by researchers. In the meantime, cybersecurity professionals advise potential buyers to cross‑reference vendor claims with independent reputation sources before committing to transactions.