thorchain-wallet-xyz[.]pages[.]dev

The domain thorchain-wallet-xyz.pages.dev was registered on April 19, 2026 and currently resolves to the Cloudflare edge address 188.114.97.3, which is geolocated to Cloudflare, Inc. in Canada. The site presents a page titled “THORChain Wallet | Secure RUNE Wallet & Cross‑Chain Swaps”, mimicking the legitimate THORChain user interface. An SSL certificate issued by Google Trust Services (WE1) is active, and the connection is forced through HSTS, indicating a fully TLS‑enabled front end.

Threat intelligence shows the domain holds a Gridinsoft trust score of 0 out of 100, and VirusTotal records a single positive detection out of 95 scanned security vendors. PhishDestroy has already added the domain to its blocklist, and it appears on one additional security blocklist. The HTTP response code is 200, confirming that the site is actively serving content. The risk rating is high and the status is marked as active.

Technical profiling reveals the use of Cloudflare’s CDN services, including HTTP/3 support and enforced HSTS headers. The authoritative nameservers are dara.ns.cloudflare.com and leif.ns.cloudflare.com, both belonging to Cloudflare. No additional infrastructure such as separate hosting or backend servers is observable beyond the published edge IP, which limits direct attribution but confirms reliance on a reputable CDN provider.

Defenders should block or sinkhole thorchain-wallet-xyz.pages.dev at the DNS layer and add the IP 188.114.97.3 to network‑level blocklists. Monitoring of outbound traffic for connections to this address, especially from wallets handling RUNE or other cross‑chain assets, is advised. Incident response teams should treat any credential or private‑key submissions to this site as compromised and advise affected users to rotate keys and revoke any on‑chain authorizations.