revoke-thorchain[.]org

PhishDestroy identifies revoke-thorchain.org as a crypto wallet drainer site impersonating the OKX exchange brand. This domain attempts to deceive users into connecting their wallets to a malicious smart contract, with the goal of draining funds under the false pretense of revoking token allowances. The site specifically abuses the Thorchain ecosystem branding to appear legitimate, leveraging fake revocation pages that are common in crypto scams targeting OKX users. The infrastructure suggests a coordinated effort to exploit brand recognition and urgency tactics, typical of drainer-as-a-service operations.

This domain was flagged by Google Safe Browsing (GSB) and detected by 3 out of 95 VirusTotal security vendors. It resolves to IP address 104.21.88.47 and was registered on May 15, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. The domain uses a Let's Encrypt SSL certificate to appear trustworthy, though this does not validate its legitimacy. The combination of brand impersonation, recent creation date, and low detection rate at time of analysis indicates elevated risk, particularly for users searching for Thorchain or OKX-related services. The domain's targeting of crypto wallet connections places it firmly in the drainer category, a high-severity threat vector in web3 environments.

revoke-thorchain.org remains active and unresolved as of this assessment. MetaMask has already implemented blocking measures against the domain, and it appears on at least one active security blocklist. No public takedown notices or sinkholing efforts have been confirmed. Users should avoid visiting this domain entirely, especially those attempting to interact with Thorchain or OKX services. Even accidental connection of a wallet to this site could result in fund loss. The domain's recent registration and low initial detection rate suggest it may be part of a larger, ongoing campaign. Affected users should revoke any unauthorized smart contract approvals immediately and monitor wallet activity for suspicious transactions. Remaining risk is elevated due to the domain's active status and the fact that advanced users may still fall victim to social engineering tactics involving fake revocation pages.