tthorchain[.]org

The domain tthorchain.org has been identified as a brand impersonation threat targeting Thorchain, a decentralized liquidity protocol. This domain is currently offline but remains under active investigation for its role in phishing operations designed to deceive users of the legitimate Thorchain platform. Analysis indicates the domain was crafted to mimic the official Thorchain brand, potentially to harvest credentials or distribute malicious payloads. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It resolves to the IP address 172.67.187.198 and is protected by Cloudflare, a common tactic to obscure hosting infrastructure. Detection metrics show the domain has been flagged by 1 of 89 security blocklists, specifically PhishDestroy, though it has not yet been detected by any of the 95 vendors on VirusTotal. The domain employs Node.js and Express for backend operations and uses a Let's Encrypt SSL certificate to appear legitimate. Gridinsoft's trust score for this domain is 0 out of 100, further indicating its suspicious nature. At present, tthorchain.org has been taken offline, though its prior activity and infrastructure warrant continued monitoring. Organizations and users are advised to block the domain and its associated IP address (172.67.187.198) at the network level. Additionally, security teams should scrutinize logs for any prior interactions with this domain, particularly those involving credential submissions or wallet-related transactions. Proactive measures, such as implementing domain monitoring for similar impersonation attempts and educating users on recognizing brand impersonation tactics, are recommended to mitigate future risks.