thorchainairdrop[.]com

Analysis of the domain thorchainairdrop.com indicates it was actively associated with a crypto drainer scam targeting users through a fraudulent airdrop scheme. The domain, registered on July 5, 2024, via NameSilo, LLC, displayed the page title 'THORChain | Airdrop,' suggesting an attempt to impersonate the THORChain brand to deceive victims into interacting with malicious crypto-draining mechanisms. As of July 25, 2026, the domain is offline, though its infrastructure remains a documented threat.

Technical evidence confirms its classification as a crypto scam. The domain appears on one security blocklist, and five of 93 security vendors on VirusTotal flagged it as malicious. The SSL certificate (R10) and phishing kit labeled 'Airdrop Scam' further corroborate its fraudulent nature.

GridinSoft assigned a trust score of 0/100, reinforcing its high-risk status. While the domain is no longer active, defenders should treat any residual DNS records, subdomains, or associated IPs as indicators of compromise. Organizations are advised to block access to this domain and monitor for related infrastructure, such as similar naming patterns or registrar ties, to prevent potential reinfection or resurgence of the threat.