thorhain[.]org

On July 28, 2026, thorhain.org was identified as an active generic phishing host. VirusTotal records show that 14 of 91 scanning engines have flagged the domain, indicating a moderate to high likelihood of malicious intent. The web server returns HTTP 200, confirming the site is online and reachable. The domain is listed on one external security blocklist and is currently blocked by the PhishDestroy service, demonstrating that at least one mitigation platform has taken action against it.

Registration data lists NICENIC INTERNATIONAL GROUP CO., LIMITED as the registrar, a detail that aligns with other known threat‑infrastructure operators that often exploit inexpensive registration services. The authoritative name servers are kelly.ns.cloudflare.com and miles.ns.cloudflare.com, confirming that the domain is using Cloudflare’s DNS infrastructure. No additional metadata such as SSL certificate details, IP geolocation, or page title has been disclosed, so the exact content and targeted brand remain unknown.

The combination of multi‑vendor detections, active HTTP response, and inclusion on a blocklist supports a high risk rating. Defenders should add thorhain.org to DNS and web‑filter deny lists, monitor outbound connections for any attempts to resolve the domain, and consider sharing the indicator with internal threat‑intel feeds. Continued observation is advised to capture any changes in hosting, content, or detection patterns that could refine the threat assessment.