thorwsap[.]com

PhishDestroy identifies thorwsap.com as an active phishing domain posing as a MetaMask login portal to harvest cryptocurrency wallet credentials. This campaign is currently elevated risk and remains unblocked by many endpoint solutions due to its recent SSL certificate issuance. Users who interact with this domain risk immediate loss of digital assets and potential follow-on identity theft.

This domain was flagged by MetaMask and SEAL security systems and appears on two security blocklists. VirusTotal analysis confirms 2 out of 95 security vendors currently detect the threat, indicating partial detection coverage. The domain uses a Google Trust Services SSL certificate and displays a deceptive page title (www.www.thorwsap.com) crafted to appear legitimate through excessive subdomain repetition. Technical indicators and detection gaps suggest this campaign is actively evolving to bypass traditional defenses.

Immediate mitigation requires users to avoid accessing thorwsap.com and verify all crypto-related URLs through official MetaMask channels. Organizations should update browser blocklists and endpoint detection rules to include this domain using the seed identifier d24112. Security teams should investigate internal DNS logs for resolution attempts and conduct user awareness training highlighting the use of lookalike domains and the critical importance of verifying SSL certificates and domain spellings before entering sensitive credentials.