appthorswap[.]app

Analysis of appthorswap.app indicates a crypto scam infrastructure impersonating the Across protocol, a known cross-chain bridge. The domain was registered through Spaceship, Inc. and configured with nameservers ns27.my-control-panel.com and ns28.my-control-panel.com, resolving to 198.251.89.220, an IP hosted by FranTech Solutions (AS53667) in the United States. No SSL certificate was detected, increasing exposure to interception risks. The page title 'THORSwap' suggests an attempt to mimic a legitimate decentralized exchange, though the exact content and functionality remain unconfirmed as the site is currently offline.

Infrastructure checks reveal the domain appears on one security blocklist, specifically PhishDestroy, and holds a Gridinsoft trust score of 0/100, indicating high-risk classification. One of 95 security vendors on VirusTotal flagged the domain, though the absence of additional context limits the weight of this detection. The domain is now offline, reducing immediate user exposure but leaving residual risk if the infrastructure is reactivated. Defenders should monitor for re-registration or DNS changes, particularly under the same nameservers or hosting provider.

The combination of crypto-themed branding, absence of encryption, and low detection coverage suggests a targeted campaign. Review logs for connections to 198.251.89.220 and correlate with wallet addresses or transaction patterns associated with Across or THORSwap impersonation. If internal users accessed the domain prior to takedown, assess for potential credential or seed phrase exposure. No phishing kit or additional artifacts have been confirmed at this time.