thorwallet-org-us[.]pages[.]dev

PhishDestroy identifies the active cryptocurrency drainer thorwallet-org-us.pages.dev impersonating legitimate wallet services to steal user funds.

Thorwallet-org-us.pages.dev operates as a crypto drainer designed to siphon cryptocurrency assets from unsuspecting users by masquerading as a wallet service. The domain leverages a sophisticated phishing kit targeting blockchain users. It resolves to IP 188.114.97.3 and is registered through Cloudflare, Inc. Security assessments reveal this domain currently evades detection with a VirusTotal score of 1 out of 95 detections, indicating it remains under the radar. The SSL certificate is issued by Google Trust Services, adding a layer of perceived legitimacy. Cloudflare's infrastructure is being exploited to host and obscure malicious activities.

Key technical indicators include a flawless VirusTotal score of 1/95, registration through Cloudflare, Inc., and association with IP address 188.114.97.3. The domain is part of Cloudflare Pages, a legitimate service often hijacked by threat actors for malicious purposes. The use of Google Trust Services for SSL certificates adds authenticity to the deception. Despite zero detections, the site has not been widely blocked yet, suggesting it is in the early stages of deployment or has evaded detection through obfuscation techniques.

This domain is currently active and poses a high risk to cryptocurrency users. Immediate response actions include blocking the domain and IP address at network and endpoint levels. Users are advised to avoid interacting with any communications or links related to thorwallet-org-us.pages.dev. Security teams should monitor for related infrastructure and update blocklists accordingly. The remaining risk is significant due to the low detection rate and the potential for rapid expansion of this campaign. Enhanced scrutiny and proactive threat hunting are recommended to mitigate the impact of this crypto drainer.