# Phishing sites impersonating Thorchain

PhishDestroy has recorded 17 phishing domains impersonating Thorchain since 2025-08-25, 0 of them in the last 30 days. The most used registrars are NiceNIC and Cloudflare; the most common TLDs are .org and .com. Open Thorchain only from its official app or a saved bookmark.

17Domains, all time

0Last 30 days

7Online at last check

5Confirmed takedowns

## New domains in the last 90 days

Thorchain phishing domains detected per day: 0 from 2026-07-25 to 2026-10-22; peak 1.

## How to tell a fake Thorchain site

Words most often added to the brand in reported domains: thorswap, wallet, faq, typedream, station, tthorchain, rune, hhorchain, rhorchain, thorchainn.
- Type the address yourself or use a bookmark; phishing links for Thorchain arrive through ads, search results, direct messages and fake support accounts.
- Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
- Thorchain will never ask for your seed phrase. Read every wallet signature: approvals, Permit and setApprovalForAll requests can hand over your assets.

Paste a suspicious address into the [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) or check it against the [DestroyList](https://phishdestroy.io/developer-tools/destroylist-check).

## Latest Thorchain phishing domains

The 17 most recently detected domains impersonating Thorchain
Domain | First detected | Status at last check | Registrar | 
[thrchain.org](https://phishdestroy.io/domain/thrchain.org/) | 2026-06-15 | Online | NICENIC | 
[thorchainswapkit.com](https://phishdestroy.io/domain/thorchainswapkit.com/) | 2026-03-18 | Offline | NameSilo | 
[thorswapvalidator.pages.dev](https://phishdestroy.io/domain/thorswapvalidator.pages.dev/) | 2026-02-26 | Offline | Cloudflare | 
[thorchain.pro](https://phishdestroy.io/domain/thorchain.pro/) | 2026-02-26 | Online | NameSilo | 
[app-thorswap-finance.pages.dev](https://phishdestroy.io/domain/app-thorswap-finance.pages.dev/) | 2026-02-26 | Offline | Cloudflare | 
[app-thorswap.finance](https://phishdestroy.io/domain/app-thorswap.finance/) | 2026-02-26 | Taken down | NameSilo | 
[v2-thorchain.net](https://phishdestroy.io/domain/v2-thorchain.net/) | 2026-02-26 | Taken down | NiceNIC | 
[v2-thorchain.org](https://phishdestroy.io/domain/v2-thorchain.org/) | 2026-02-26 | Unknown | NiceNIC | 
[thorswap-photon.pages.dev](https://phishdestroy.io/domain/thorswap-photon.pages.dev/) | 2026-02-26 | Offline | Cloudflare | 
[app-thorchain.com](https://phishdestroy.io/domain/app-thorchain.com/) | 2026-02-23 | Offline | Dynadot | 
[thorchainn.org](https://phishdestroy.io/domain/thorchainn.org/) | 2026-02-16 | Unknown | NiceNIC | 
[rhorchain.org](https://phishdestroy.io/domain/rhorchain.org/) | 2026-02-13 | Online | NiceNIC | 
[hhorchain.org](https://phishdestroy.io/domain/hhorchain.org/) | 2026-02-13 | Online | NiceNIC | 
[thorchain.org-rune.ink](https://phishdestroy.io/domain/thorchain.org-rune.ink/) | 2026-01-24 | Taken down | NiceNIC | 
[tthorchain.org](https://phishdestroy.io/domain/tthorchain.org/) | 2026-01-22 | Taken down | NiceNIC | 
[station-thorswap.com](https://phishdestroy.io/domain/station-thorswap.com/) | 2025-12-03 | Unknown | NiceNIC | 
[thorchain-wallet-faq.typedream.app](https://phishdestroy.io/domain/thorchain-wallet-faq.typedream.app/) | 2025-08-25 | Taken down | Typedream | 

[All 17 Thorchain reports](https://phishdestroy.io/domain/?brand=Thorchain)

## Where they are registered and hosted

### Registrars

- [NiceNIC](https://phishdestroy.io/registrar/nicenic/)8
- Cloudflare3
- [NameSilo](https://phishdestroy.io/registrar/namesilo/)3
- Typedream1
- [Dynadot](https://phishdestroy.io/registrar/dynadot/)1
- [NICENIC](https://phishdestroy.io/registrar/nicenic/)1

### Top-level domains

- [.org](https://phishdestroy.io/tld/org/)6
- [.com](https://phishdestroy.io/tld/com/)3
- [.dev](https://phishdestroy.io/tld/dev/)3
- [.app](https://phishdestroy.io/tld/app/)1
- [.ink](https://phishdestroy.io/tld/ink/)1
- [.net](https://phishdestroy.io/tld/net/)1
- [.finance](https://phishdestroy.io/tld/finance/)1
- [.pro](https://phishdestroy.io/tld/pro/)1

### Hosting networks

- Cloudflare, Inc.7
- CLOUDFLARENET, US6
- CLOUDFLARENET - Cloudflare, Inc., US2
- GOOGLE, US1
- hostbet HostBet Cloud Technologies Private Limit1

## Related

- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/)
- [Homoglyph](https://phishdestroy.io/glossary/homoglyph/)
- [Phishing kit](https://phishdestroy.io/glossary/phishing-kit/)
- [Wallet drainer](https://phishdestroy.io/glossary/wallet-drainer/)
- [Seed phrase phishing](https://phishdestroy.io/glossary/seed-phrase-phishing/)
- [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker)
- [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator)
- [If you already used a fake site: emergency guide](https://phishdestroy.io/critical-action)
- [All impersonated brands](https://phishdestroy.io/brand/)

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Thorchain; share of all PhishDestroy reports: 0.01%.

Canonical: https://phishdestroy.io/brand/thorchain/