thorchain[.]pages[.]dev

This domain is flagged as a generic phishing site. It was created on February 6 2024 and is hosted via Cloudflare Pages, resolving to the IP address 172.66.47.203, which resides within Cloudflare’s edge network. The domain appears on three independent blocklists—PhishDestroy, ScamSniffer, and Enkrypt—demonstrating that multiple threat‑intelligence providers have classified it as malicious.

VirusTotal scanning recorded eight positive detections out of ninety‑one security vendors, providing concrete vendor‑level evidence of suspicious activity. The current intelligence set does not include details on SSL certificate parameters, HTTP response codes, or the page title, leaving the exact content of the site unverified. Nevertheless, the combination of blocklist listings, vendor detections, and the elevated risk rating indicates a high likelihood that the domain is being used to harvest credentials or redirect victims to malicious payloads.

Defenders should treat the domain as hostile: incorporate thorchain.pages.dev into URL filtering, DNS sink‑hole, and firewall deny rules; block outbound traffic to 172.66.47.203 at the network perimeter; and monitor for any additional domains that resolve to the same IP, as Cloudflare’s shared infrastructure can host multiple unrelated sites. Ongoing surveillance is recommended to capture any future changes in page content, additional detection signatures, or new blocklist entries that could refine the threat profile.