VirusTotal
14 / 95
BildirInterpretation & limits
Engine detections from this stored analysis. Vendors and collection times may differ from other sources.
Assessment based on the stored source evidence below. Review sources →
app.thorrswap.finance — İçerik kullanılamıyor. Dolandırıcılık türü: Crypto Scam. Kanıt özeti: VirusTotal 14/95 (ChainPatrol, BitDefender, CyRadar, ESET, Fortinet); 1 external blocklist match (ScamSniffer); CF Radar malicious; PhishDestroy score 100/100. Kayıt kuruluşu: Tucows.
Özgün adli kaydı korumak için aşağıdaki ayrıntılı PhishDestroy AI analizi İngilizce bırakılmıştır.
These are dated observations, not a live safety check. No flag, a stored capture, or a completed analysis does not establish that a site is safe.
14 / 95
BildirEngine detections from this stored analysis. Vendors and collection times may differ from other sources.
provider verdict: malicious
A result applies to the recorded source and observation time. Absence of a flag is not proof of safety.
6/14
A result applies to the recorded source and observation time. Absence of a flag is not proof of safety.
1 external matches
AyrıntılarA result applies to the recorded source and observation time. Absence of a flag is not proof of safety.
checked — no match recorded
A result applies to the recorded source and observation time. Absence of a flag is not proof of safety.
no community references
BildirCommunity publication references, not a vendor verdict or evidence of a common operator.
saklanan rapor
View stored capture ↗ BildirA preserved page image documents what the collector received; a capture is not a safety verdict.
Analiz tamamlandı
BildirThis is the recorded automated analysis. Completion alone is not a safety verdict.
Checked; no threat flag recorded
BildirA result applies to the recorded source and observation time. Absence of a flag is not proof of safety.
Stored narrative · generated . Provider checks below retain their own observation dates.
This domain, app.thorrswap.finance, is flagged as a high-risk crypto phishing site designed to mimic legitimate decentralized exchange platforms. Analysis indicates the domain impersonates ThorSwap, a known cross-chain swap service, likely deploying a wallet drainer kit to harvest private keys or seed phrases. The infrastructure is structured to deceive users into connecting wallets, enabling unauthorized asset transfers upon interaction. No legitimate association with the authentic ThorSwap platform has been identified, and the domain exhibits classic phishing hallmarks, including spoofed branding and fraudulent transaction prompts. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 23.254.225.152, hosted on AS54290 (Hostwinds LLC, Netherlands). It was registered on June 22, 2025, through Tucows Domains Inc., with no SSL certificate deployed, increasing susceptibility to interception. VirusTotal reports 14 out of 95 security vendors flagging the domain as malicious, while it appears on three distinct security blocklists. Google Safe Browsing (GSB) currently lists the domain as unsafe, corroborating its fraudulent nature. The absence of encryption and recent registration further align with typical phishing lifecycle patterns. As of the latest assessment, app.thorrswap.finance has been taken offline, likely due to enforcement actions or hosting provider intervention. However, residual risk persists, as threat actors may re-deploy the domain or migrate infrastructure to new endpoints. Users who interacted with the site should immediately revoke wallet permissions, transfer assets to new wallets, and monitor for unauthorized transactions. Organizations are advised to update blocklists with the domain and IP, while end-users should verify URLs via official sources before connecting wallets. The lack of SSL and recent creation date remain critical red flags for similar threats.
What this report contains, where it came from, and when it was collected. A retained record can be incomplete; collection status is separate from the threat assessment.
These checks have no retained result. This does not mean they passed or that a scan is running.
For the registrable domain thorrswap.finance behind this subdomain, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
3-get.njalla.foLocation describes the IP network.
An estimated time describes an observation window. It does not prove a registrar action or the exact moment a site became unavailable.
Bu ana bilgisayar için saklanmış tarayıcı-karşı-tarayıcı gözlemleri ile Keitaro tarzı trafik dağıtım sistemleri için gerçek zamanlı parmak izi kontrolü.
Tarayıcı notu: unavailable: raw=connection_error; http=0; via=http_proxy; error=SOCKSHTTPConnectionPool(host='app.thorrswap.finance', port=80): Max retries exceeded with url: / (Caused by NewConnectio
Dated changes retained by the monitor and source collectors. Newest observations appear first; source states are not proof of a takedown.
dns_inactive→Bilinmiyor
probe_inconclusive
Bilinmiyor→dns_inactive
dns_nxdomain
dns_inactive→Bilinmiyor
probe_inconclusive
Bilinmiyor→dns_inactive
dns_nxdomain
dns_inactive→Bilinmiyor
probe_inconclusive
Bilinmiyor→dns_inactive
dns_nxdomain
dns_inactive→Bilinmiyor
probe_inconclusive
Bilinmiyor→dns_inactive
dns_nxdomain
dns_inactive→Bilinmiyor
origin_unreachable · http_5xx
Bilinmiyor→dns_inactive
dns_nxdomain
dns_inactive→Bilinmiyor
origin_unreachable · http_5xx
Bilinmiyor→dns_inactive
dns_nxdomain
dns_inactive→Bilinmiyor
origin_unreachable · http_5xx
dns_inactive
dns_nxdomain
Erişilebilir→Mevcut değil
audit_replace→https://radar.cloudflare.com/scan/f70e9db3-397f-4817-898c-c1f5068e955f
14→15
https://radar.cloudflare.com/scan/add6ee86-9496-4212-bb68-c108213b4af0
16 recorded events. These records describe collected evidence, outgoing notifications and publication; they do not confirm a complete investigation or a takedown.
We scan suspicious URLs, inspect public results and send evidence through the appropriate abuse-reporting channels. The dated events above show what is recorded for this domain. The directory below explains the wider workflow.
Capture the rendered page, requests and visible infrastructure.
Compare the available engine results and retain the analysis timestamp.
Check whether Google currently lists the URL as unsafe.
Inspect a public scan and its recorded network and classification data.
Look for indicator references and related community intelligence.
Compare archived captures and preserve historical context.
Look for matching indicators and associated threat records.
Inspect certificate records and related hostnames.
Compare security resolver responses and record observed blocking.
Inspect the public DNS, TLS, HTTP and technology surface.
Security services used for scanning, reputation checks and reporting are listed below. A service being listed is not evidence that it received, accepted or acted on this particular domain. Recorded submissions appear in the notification history above.
1 topluluk raporu
KategoriPHISHING
Detection Summary The Anti-Phishing Volunteers & Associates Security Incident Response System has flagged this as a domain threat, classified as phishing attack against several brands. Threat detected at 2025-07-21T04:54:22.380Z. Targeted Brands Velodrome Finance ThorSwap Bi
1 topluluk üyesi tarafından bildirildi; ilk görülme 13.07.2025
Hesap kimlik bilgilerini, kişisel bilgileri veya ödeme bilgilerini girdiyseniz ya da bu alan adından bir dosya indirdiyseniz hemen harekete geçin. Aşağıda olayı bildirmenize ve kendinizi korumanıza yardımcı olacak kaynaklar bulunmaktadır.
resmi siber suç iletişim bilgileri veya şikayet taslağı oluştur → almak için ülkenizi seçin.
Template-based draft · optional AI wording assistance requires separate consent
Saklanan engelleme listesi, WHOIS, DNS ve genel tarama kanıtlarını kullanarak tehdit analizi
Şimdi TaraŞüpheli alan adlarını tehdit veritabanımıza bildirin — topluluğu koruyun
BildirSon kimlik avı raporları ve gözlemlenen kullanılabilirlik değişiklikleri
İzleCanlı tehditleri izleyin veya bunun yanlış bir uyarı olduğunu düşünüyorsanız bu kayda itiraz edin