thorchain[.]org-rune[.]ink

The domain thorchain.org-rune.ink was registered on February 21, 2026 through NiceNIC International Group Co., Limited and immediately began serving content that presented a page titled “THORChain Swap.” Technical fingerprinting shows the site was hosted behind Cloudflare, using Cloudflare Browser Insights and HTTP/3, and resolved to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. in the United States. The SSL certificate was issued by Google Trust Services under the WE1 root, indicating a valid TLS handshake but offering no assurance of legitimacy. The site employed a known “Seed Phrase Phishing” kit and was classified as a brand‑impersonation campaign targeting Thorchain, attempting to harvest cryptocurrency seed phrases from unsuspecting users. VirusTotal scans recorded two positive detections out of ninety‑three security vendors, and the domain appeared on a single external blocklist before being taken offline.

It was also listed by PhishDestroy as a malicious resource. Nameservers listed were peyton.ns.cloudflare.com and mary.ns.cloudflare.com, consistent with the Cloudflare infrastructure. Current status is offline, but the underlying hosting and DNS setup remain active, allowing rapid re‑deployment.

Uncertainty remains around the exact content served prior to takedown, as no visual analysis is available. Defenders should continue to block the domain at perimeter and endpoint layers, monitor the associated IP 188.114.96.3 for any future hosting of similar phishing kits, and add the domain to internal threat‑intel feeds. Organizations using Thorchain services should issue user advisories warning against unsolicited links to “THORChain Swap” pages that do not originate from official Thorchain domains, and enforce multi‑factor authentication for wallet access to mitigate seed‑phrase compromise.