tnorchain[.]org

This domain, tnorchain.org, is flagged as a generic phishing site targeting users of the THORChain decentralized exchange platform. Analysis indicates the site impersonates the legitimate THORChain interface, likely to harvest wallet credentials, seed phrases, or private keys from unsuspecting victims. The page title explicitly displays 'THORChain,' and the site employs Node.js and Express for backend operations, alongside Cloudflare Browser Insights and HTTP/3 for performance and obfuscation. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with malicious domains. It resolves to the IP address 172.67.144.153, which is part of Cloudflare’s network, a common tactic to mask the true origin of phishing infrastructure. The SSL certificate is issued by Google Trust Services, adding a veneer of legitimacy. Detection metrics show the domain appears on 1 security blocklist, while VirusTotal reports 0/95 detections, indicating it may still evade widespread automated detection. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious nature. As of the latest assessment, tnorchain.org has been taken offline, likely due to manual takedown efforts or hosting provider intervention. However, the domain remains registered, and the infrastructure could be reactivated or repurposed for future campaigns. Users who interacted with the site should assume credential compromise and take immediate action, including revoking wallet access, monitoring for unauthorized transactions, and rotating any exposed secrets. Organizations are advised to block the domain and associated IP at the network level to prevent potential re-emergence.