thorchain-cu5[.]pages[.]dev

Analysis of thorchain-cu5.pages.dev indicates an active high‑risk phishing infrastructure. The domain was registered on March 17, 2024 through Cloudflare Pages, a service that provides automated static site hosting and automatically provisions SSL certificates. DNS resolution points to the IP address 172.66.47.187, which belongs to the Cloudflare network and is commonly leveraged by threat actors to obscure true hosting locations. Google Safe Browsing has flagged the domain for social engineering, confirming that it is being used to deceive users.

Independent threat‑intelligence feeds have added the domain to three security blocklists, and it is currently blocked by PhishDestroy, ScamSniffer, and Enkrypt. VirusTotal scans show that 16 of 91 security vendors have flagged the domain, reinforcing the suspicion of malicious activity. The combination of a recent registration date, Cloudflare‑based hosting, and multiple vendor detections suggests a purpose‑built phishing campaign rather than a compromised legitimate site.

No public page title or content analysis is available, so the exact lure or targeted brand cannot be confirmed at this time. Defenders should treat any URLs containing thorchain-cu5.pages.dev as hostile, block network traffic to the associated IP, and incorporate the domain into URL filtering policies. Continuous monitoring of Cloudflare‑hosted subdomains and periodic re‑scanning with sandbox tools are recommended to detect any evolution of the payload or the emergence of new malicious pages under the same infrastructure.