# PhishDestroy domain threat record: thorchain-swap.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/thorchain-swap.com/ Machine-readable companion: https://phishdestroy.io/domain/thorchain-swap.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-23 09:56:33 UTC - Last availability or vendor check: 2026-10-25 23:33:08 UTC - Stored record updated: 2026-10-25 23:33:08 UTC - VirusTotal detections in the stored snapshot: 1/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: ethereum ## Stored infrastructure - Observed IP address: 104.21.10.138 - Registrar in stored WHOIS data: Internet Domain Service BS Corp. - Registrar country in stored WHOIS data: BS - Last stored HTTP status: 200 - Registration date (registry RDAP, thorchain-swap.com): 2026-09-22 16:26:02 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a16833-e045-734a-bb3f-08f65d0a664c/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/thorchain-swap.com - Certificate Transparency search: https://crt.sh/?q=%25.thorchain-swap.com - Web Archive lookup: https://web.archive.org/web/*/https://thorchain-swap.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s automated assessment classified thorchain-swap.com as an impersonation phishing page because it uses the THORChain name and branding on a different domain. The recorded page title advertises “Crypto DEX | Swap BTC, ETH, & XMR | No KYC | THORChain”, and the domain was first seen by PhishDestroy on 2026-10-23, returning HTTP 200. How the scam works Impersonation phishing sites for cryptocurrency services recreate the look and language of legitimate platforms to trick visitors into providing wallet credentials or approving transactions. By promising swaps without KYC, bridges or wrapped tokens, they rely on brand trust to harvest private keys or approvals that can be used to drain funds. Evidence VirusTotal reported one suspicious detection from the Ermes engine out of 92 scanners on 2026-10-23. Google Safe Browsing showed no flag on the same date. URLScan’s machine‑learning engine labeled the site malicious with a score of 99, though its overall verdict was clean, on 2026-10-23. OTX listed four pulses mentioning the domain on 2026-10-23. External blocklists MetaMask and SEAL flagged the domain, and PhishDestroy’s internal list includes it as malicious, all checked on 2026-10-23. Infrastructure The domain was registered on 2026-09-22 through Internet Domain Service BS Corp, giving it a 30‑day age at first sighting. It resolved to Cloudflare‑served IPs 104.21.10.138 and 172.67.190.54, with a TLS certificate issued by Google Trust Services valid until 2026-12-22. Cloudflare edge location was recorded in Toronto, Canada, and DNSSEC was not present. What to do Avoid visiting or interacting with thorchain-swap.com; do not enter credentials or connect wallets. Organizations should block the domain at the network perimeter, monitor for traffic to its IP addresses, review logs for related activity, and educate users about brand‑impersonation phishing tactics. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a16833-e045-734a-bb3f-08f65d0a664c/ Cloudflare Radar report: https://radar.cloudflare.com/scan/601d60f9-e5c3-4439-8c11-08ff0c1698e5 URLQuery report: https://urlquery.net/report/f4565f26-4861-449d-b6db-8e906ccb9c6d Stored capture screenshot: https://i.ibb.co/KjVV7jtp/fbf31b62f893.png Cloudflare Radar screenshot (2026-10-23T09:59:25Z): https://screenshots.phishdestroy.io/cf/601d60f9-e5c3-4439-8c11-08ff0c1698e5.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/f4565f26-4861-449d-b6db-8e906ccb9c6d.png URLScan screenshot (2026-10-10T20:42:53Z): https://screenshots.phishdestroy.io/us/01a1278d-d174-7488-8436-4414db3b05f6.png URLScan capture report: https://urlscan.io/result/01a1278d-d174-7488-8436-4414db3b05f6/ URLScan screenshot (2026-10-15T08:53:50Z): https://screenshots.phishdestroy.io/us/01a13ec4-71a5-736c-8443-e8f69815cca1.png URLScan capture report: https://urlscan.io/result/01a13ec4-71a5-736c-8443-e8f69815cca1/ URLScan screenshot (2026-10-19T08:39:26Z): https://screenshots.phishdestroy.io/us/01a15350-b55c-77ca-a915-781045c1a708.png URLScan capture report: https://urlscan.io/result/01a15350-b55c-77ca-a915-781045c1a708/ URLScan screenshot (2026-10-19T17:28:36Z): https://screenshots.phishdestroy.io/us/01a15535-2b19-73ae-8396-a0d8a1780a40.png URLScan capture report: https://urlscan.io/result/01a15535-2b19-73ae-8396-a0d8a1780a40/ URLScan screenshot (2026-10-23T08:18:30Z): https://screenshots.phishdestroy.io/us/01a167d6-efce-7596-aee2-9873b879b268.png URLScan capture report: https://urlscan.io/result/01a167d6-efce-7596-aee2-9873b879b268/ URLScan screenshot (2026-10-23T10:02:48Z): https://screenshots.phishdestroy.io/us/01a16835-d392-70cc-867e-3cb9ac6da8c5.png URLScan capture report: https://urlscan.io/result/01a16835-d392-70cc-867e-3cb9ac6da8c5/ VirusTotal report: https://www.virustotal.com/gui/domain/thorchain-swap.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=thorchain-swap.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-23 12:11:15 UTC ## Stored page captures - Primary capture: https://i.ibb.co/KjVV7jtp/fbf31b62f893.png Captured: 2026-10-23 10:00:48 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a16833-e045-734a-bb3f-08f65d0a664c.png Captured: 2026-10-23 10:00:48 UTC Source report: https://urlscan.io/result/01a16833-e045-734a-bb3f-08f65d0a664c/ - URLScan capture 2: https://urlscan.io/screenshots/01a167d6-efce-7596-aee2-9873b879b268.png Captured: 2026-10-23 09:56:33 UTC Source report: https://urlscan.io/result/01a16833-e045-734a-bb3f-08f65d0a664c/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/601d60f9-e5c3-4439-8c11-08ff0c1698e5.png Captured: 2026-10-23 09:59:25 UTC Source report: https://radar.cloudflare.com/scan/601d60f9-e5c3-4439-8c11-08ff0c1698e5 SHA-256: 2cc1e2973fb302d34ece075785bf4ac03233fb177121c75227c1db9e546943b6 - URLQuery: https://screenshots.phishdestroy.io/uq/f4565f26-4861-449d-b6db-8e906ccb9c6d.png Source report: https://urlquery.net/report/f4565f26-4861-449d-b6db-8e906ccb9c6d SHA-256: 00cc9d5cf7c8de2727d7d0a165363af65c030047ea515cbb3c9f5da180486eb2 - URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a1278d-d174-7488-8436-4414db3b05f6.png Captured: 2026-10-10 20:42:53 UTC Source report: https://urlscan.io/result/01a1278d-d174-7488-8436-4414db3b05f6/ SHA-256: e220270563fb2086a0993a1f5015b293f09083705199da89b05c2f7482c4611d - URLScan · 2026-10-15: https://screenshots.phishdestroy.io/us/01a13ec4-71a5-736c-8443-e8f69815cca1.png Captured: 2026-10-15 08:53:50 UTC Source report: https://urlscan.io/result/01a13ec4-71a5-736c-8443-e8f69815cca1/ SHA-256: e220270563fb2086a0993a1f5015b293f09083705199da89b05c2f7482c4611d - URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a15350-b55c-77ca-a915-781045c1a708.png Captured: 2026-10-19 08:39:26 UTC Source report: https://urlscan.io/result/01a15350-b55c-77ca-a915-781045c1a708/ SHA-256: e220270563fb2086a0993a1f5015b293f09083705199da89b05c2f7482c4611d - URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a15535-2b19-73ae-8396-a0d8a1780a40.png Captured: 2026-10-19 17:28:36 UTC Source report: https://urlscan.io/result/01a15535-2b19-73ae-8396-a0d8a1780a40/ SHA-256: e220270563fb2086a0993a1f5015b293f09083705199da89b05c2f7482c4611d - URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a167d6-efce-7596-aee2-9873b879b268.png Captured: 2026-10-23 08:18:30 UTC Source report: https://urlscan.io/result/01a167d6-efce-7596-aee2-9873b879b268/ SHA-256: e220270563fb2086a0993a1f5015b293f09083705199da89b05c2f7482c4611d - URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16835-d392-70cc-867e-3cb9ac6da8c5.png Captured: 2026-10-23 10:02:48 UTC Source report: https://urlscan.io/result/01a16835-d392-70cc-867e-3cb9ac6da8c5/ SHA-256: 087aa7b47a994efeca290177e8bf29df722da1ea64e9496768cd286097e8030e ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-23T11:03:35Z", "uuid": "01a16833-e045-734a-bb3f-08f65d0a664c", "scanned_at": "2026-10-23T09:59:57Z", "final_url": "https://thorchain-swap.com/", "status": 200, "ip": "172.67.190.54", "domains": [ "cdn.sanity.io", "static.hotjar.com" ], "ips": [ "18.66.102.106", "34.149.250.58", "172.67.190.54" ], "asns": [ "16509", "396982", "13335" ], "countries": [ "US" ], "link_domains": [ "docs.thorchain.org", "github.com", "gitlab.com", "dev.thorchain.org", "tcecosystem.guide", "xchainjs.org", "thorchain.net", "runescan.io", "viewblock.io", "thornode.network", "thorchain.network", "rune.tools", "xscanner.org", "x.com", "t.me", "blockworks.com", "messari.io", "investors.defillama.com", "dune.com", "raynalytics.net", "thorcharts.org", "www.youtube.com", "gateway.liquify.com", "apiv2.liquify.com", "api-thor.liquify.com", "rujira.network", "www.mayaprotocol.com", "www.liquify.com", "berserkmarketingltd.com", "unstoppable.money" ], "social": [ "https://github.com/thorchain/Resources/tree/master/Audits", "https://x.com/THOR_InfoBot", "https://t.me/thor_infobot", "https://t.me/thorchain_alert", "https://t.me/thorchain_dev", "https://www.youtube.com/@GrassRootsCrypto", "https://x.com/thorchain", "https://t.me/thorchain_org", "https://discord.com/invite/thorchaindevs", "https://www.youtube.com/@THORChainCommunity", "https://www.instagram.com/thorchain", "https://www.facebook.com/THORChain", "https://www.tiktok.com/@thorchaincontact" ], "doc_hash": "389f85d0c5026149dd2e2ea78fd7ed917b08a8a52740d20ce4332e5e938f4b34", "script_hashes": [ "01174d472a41fb1f4d27892e0c935e6c13223fc0280f42c0ce6d50e283872c16", "731ec53a7045a83bba34a82a8e0a3ae018c64cd18f87ad5d7d8df3108dc19479", "dfb35111a3aeb7b6371572ee6f4c6996af781a72983f29186ddec828b0068ad5", "5f444727c3c98d076cea6d72a8a14ede1ce6e81a83b55eba5191d000a04c9a9f", "d070398ae822fe648c730219891ec527af37712ae3894a076069df9372c77b97", "73b8156d7141cec70eacf8e31172eb2a87092bee38e63653495f7f88c3ad3587", "0ce4dbde68b9f02d48eadd6af899744d890bd8889c35c4b3fd5162ae895787a8", "d314f4b47ec3404e999b96af862d03c1e1c3ef3d4f0587e8010e299782eaee7f", "d59d4d86a52cc56eaf33db9d42b23a2a76e5a7b7f530ff2635240c11ca333726", "d2f0fcf7b8d83c9b50c050cc049cb501eb385d8268dc852eb221e91e92d43553" ], "globals": [ "hj", "_hjSettings", "__NUXT__", "hjSiteSettings", "hjLazyModules", "hjBootstrap" ], "tls": { "san": [ "thorchain-swap.com", "*.thorchain-swap.com" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "thorchain-swap.com", "protocol": "QUIC", "valid_to": "2026-12-22T00:38:53Z", "valid_from": "2026-09-22T23:38:57Z" }, "domain_age_days": 30, "apex_age_days": 30, "tls_age_days": 30, "tls_valid_days": 90, "requests": 40, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-23T10:00:09Z", "uuid": "601d60f9-e5c3-4439-8c11-08ff0c1698e5", "scanned_at": "2026-10-23T09:59:25Z", "final_url": "https://thorchain-swap.com/", "status": 200, "history": [ { "url": "https://thorchain-swap.com/", "status": 200 } ], "dom_hash": "2fefcfdaba529fd70c20f94d35a2703941533856a175b2918e6850a967e8de7b", "doc_hash": "08981bbd63d8eaea980c94f9c3c3879d703999435de62bf3bb0b2f782b777d6c", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "thorchain-swap.com", "type": "A", "value": "172.67.190.54" }, { "name": "thorchain-swap.com", "type": "A", "value": "104.21.10.138" }, { "name": "thorchain-swap.com", "type": "AAAA", "value": "2606:4700:3034::ac43:be36" }, { "name": "thorchain-swap.com", "type": "AAAA", "value": "2606:4700:3037::6815:a8a" } ], "dnssec_valid": false, "ip": "172.67.190.54", "whois": { "registrar": "Internet Domain Service BS Corp", "created": "2026-09-22T16:26:02Z", "updated": "2026-09-22T16:26:05Z", "expires": "2027-09-22T16:26:02Z", "nameservers": [ "earl.ns.cloudflare.com", "zainab.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-23T12:01:36Z", "analysis_at": "2026-10-23T10:39:18Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 1, "undetected": 36 }, "detections": { "Ermes": "not recommended" }, "reputation": 0, "registrar": "Internet Domain Service BS Corp", "created": "2026-09-22T16:26:02Z", "expires": "2027-09-22T16:26:02Z", "updated": "2026-09-22T16:26:05Z", "first_seen": "2026-09-22T16:45:28Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "zainab.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "earl.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3037::6815:a8a" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3034::ac43:be36" }, { "ttl": 300, "type": "A", "value": "172.67.190.54" }, { "ttl": 300, "type": "A", "value": "104.21.10.138" }, { "ttl": 3600, "type": "TXT", "value": "google-site-verification=IFFw1Zt3Ayb2-6YXjDs5tUyw_9mWIASsmKetEIi14kQ" }, { "ttl": 21600, "type": "NS", "value": "earl.ns.cloudflare.com" } ], "dns_at": "2026-10-23T10:44:38Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "thorchain-swap.com", "*.thorchain-swap.com" ], "issuer": "Google Trust Services / WE1", "serial": "dac199efc035554d0e6f5ffb35c2819a", "sha256": "e8501687aa151034d7c7c1806f749342e338e6b1a5df67d602ea470bf86480d3", "subject": "thorchain-swap.com", "valid_to": "2026-12-22T00:38:53Z", "valid_from": "2026-09-22T23:38:57Z" }, "whois": { "registrar": "Internet Domain Service BS Corp", "registrar_iana_id": "2487", "registrar_url": "http://www.internet.bs", "created": "2026-09-22T16:26:02Z", "updated": "2026-09-22T16:26:05Z", "expires": "2027-09-22T16:26:02Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "earl.ns.cloudflare.com", "zainab.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "expiration": "2027-09-22T16:26:02Z", "last changed": "2026-09-22T16:26:05Z", "registration": "2026-09-22T16:26:02Z", "registrar expiration": "2027-09-22T16:26:02Z", "last update of RDAP database": "2026-10-23T10:44:38Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-23T10:00:23Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "thorchain-swap.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-23T09:57:07Z", "first": "2026-10-23T09:57:07Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 48207 }, "robots_txt": { "agents": [ "*", "Googlebot", "Bingbot", "Slurp", "DuckDuckBot" ], "present": true, "sitemaps": [ "https://thorchain-swap.com/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 20 }, "social_tags": { "ogUrl": "https://thorchain-swap.com/", "title": "Crypto DEX | Swap BTC, ETH, & XMR | No KYC | THORChain", "ogType": "website", "ogImage": "https://cdn.sanity.io/images/355nlzcp/production/3002bfb907d8b602a751735e18dfb2e72f9bd90c-2400x1260.png", "ogTitle": "Crypto DEX | Swap BTC, ETH, & XMR | No KYC | THORChain", "ogSiteName": "THORChain", "description": "THORChain is the leading decentralized exchange for Bitcoin. Swap Ethereum, Monero, and more without KYC, bridges, wrapped tokens, or off-chain transactions.", "twitterCard": "summary_large_image", "twitterSite": "@THORChain", "canonicalUrl": "https://thorchain-swap.com/", "ogDescription": "THORChain is the leading decentralized exchange for Bitcoin. Swap Ethereum, Monero, and more without KYC, bridges, wrapped tokens, or off-chain transactions." }, "trackers": { "requests": 37 }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 14, "tls": 18, "wait": 207, "connect": 8, "download": 38 }, "response_ms": 285 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 275921, "co2_grams": 0.0101, "cleaner_than": 1 }, "dns_server": { "ns": [ { "ip": "172.64.34.149", "host": "zainab.ns.cloudflare.com" }, { "ip": "108.162.193.161", "host": "earl.ns.cloudflare.com" } ], "zone": "thorchain-swap.com" }, "location": { "ip": "2606:4700:3034::ac43:be36", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "thorchain-swap.com" }, "dns": { "A": [ "104.21.10.138", "172.67.190.54" ], "NS": [ "zainab.ns.cloudflare.com", "earl.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"earl.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2415699726, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "TXT": [ "google-site-verification=IFFw1Zt3Ayb2-6YXjDs5tUyw_9mWIASsmKetEIi14kQ" ], "AAAA": [ "2606:4700:3034::ac43:be36", "2606:4700:3037::6815:a8a" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3037::6815:a8a", "family": 6 }, "redirects": { "chain": [ "https://thorchain-swap.com" ] }, "tech_stack": { "technologies": [ "Node.js", "Vue.js", "Nuxt.js", "Cloudflare", "Open Graph", "HTTP/3" ] }, "social_presence": { "profiles": [ "https://x.com/THORChain" ] }, "linked_pages": { "external": [ "https://unstoppable.money/", "https://docs.thorchain.org/", "https://github.com/thorchain/Resources/tree/master/Audits", "https://gitlab.com/thorchain", "https://dev.thorchain.org/", "https://gitlab.com/boonew/tcli", "https://tcecosystem.guide/index.html", "https://gitlab.com/thorchain/thornode/-/blob/develop/bugbounty.md", "https://xchainjs.org/", "https://thorchain.net/dashboard", "https://runescan.io/fr", "https://viewblock.io/thorchain", "https://thornode.network/", "https://thorchain.network/nodes", "https://rune.tools/", "https://xscanner.org/", "https://x.com/THOR_InfoBot", "https://t.me/thor_infobot", "https://t.me/thorchain_alert", "https://t.me/thorchain_dev", "https://blockworks.com/analytics/thorchain", "https://messari.io/dashboards/thorchain", "https://investors.defillama.com/thorchain", "https://dune.com/thorchain/thorchain-overview", "https://raynalytics.net/" ], "external_count": 70, "internal_count": 22 }, "whois": { "registrar": "Internet Domain Service BS Corp", "created": "2026-09-22T16:26:02Z", "updated": "2026-09-22T16:26:05Z", "expires": "2027-09-22T16:26:02Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "earl.ns.cloudflare.com", "zainab.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html" } } } } ```