thane-ritchie[.]com

The domain thane-ritchie.com has been confirmed as a brand_impersonation site targeting Ankr, a recognized blockchain infrastructure provider. Analysis indicates the domain is currently offline, though prior activity suggests malicious intent to deceive users by mimicking legitimate Ankr services. The page title, 'Information Central - A.R. Thane Ritchie Information,' does not align with Ankr's official branding, further supporting the impersonation classification. Infrastructure analysis reveals multiple high-risk indicators. The domain was flagged by 13 of 95 security vendors on VirusTotal, a notable detection rate for a recently registered domain. It was created on April 10, 2024, and registered through GoDaddy.com, LLC. The domain resolves to the IP address 50.190.97.243, located in the United States under AS7922 (Comcast Cable Communications, LLC). It appears on one security blocklist and lacks an SSL certificate, a common red flag for fraudulent sites. These technical indicators collectively point to a deliberate effort to impersonate Ankr for malicious purposes. Current status confirms the domain has been taken offline, likely due to enforcement actions. However, the infrastructure and registration details remain relevant for historical analysis and threat correlation. Organizations and users are advised to block this domain at the network level and monitor for any re-registration attempts under similar naming conventions. Security teams should review logs for connections to the IP address 50.190.97.243 and investigate any associated domains registered through the same registrar during the same timeframe. Proactive measures, such as updating blocklists and educating users on brand impersonation tactics, are recommended to mitigate similar threats.