thorchain-dex[.]com

This domain operates as a credential harvesting portal targeting users of decentralized finance platforms by mimicking the THORChain cross-chain swap interface. Analysis indicates the site is designed to capture wallet login details, seed phrases, and private keys under the guise of enabling native asset swaps. The fraudulent infrastructure uses a page title of 'THORChain DEX — Native Cross-Chain Swaps' to deceive visitors into believing they are interacting with a legitimate service, while covertly exfiltrating sensitive authentication data to command-and-control servers. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain thorchain-dex.com was registered on April 14, 2026, through GoDaddy.com, LLC, and currently resolves to the IP address 186.2.175.35, hosted on a Russian autonomous system (AS59692). Security telemetry shows the domain is flagged by 16 out of 95 vendors on VirusTotal, and appears on three independent blocklists. The site employs a Let's Encrypt SSL certificate (R13) to create a false sense of security, while being actively blocked by multiple endpoint protection mechanisms and browser-based threat detection systems. Users who have visited thorchain-dex.com or entered credentials on the site should immediately revoke access to any connected wallets and transfer assets to new, secure addresses. All potentially exposed credentials, including seed phrases and private keys, must be considered compromised. Affected individuals should monitor transaction histories for unauthorized activity and report the incident to relevant platform security teams. The domain remains active as of this report, and continued exposure poses a high risk of financial loss through unauthorized asset transfers.