thorswap-photon[.]pages[.]dev

The domain thorswap-photon.pages.dev is a cryptocurrency phishing site that impersonates Thorchain, a legitimate decentralized exchange. This brand impersonation scam aims to deceive users into connecting their wallets or entering sensitive information, potentially leading to unauthorized access or fund theft. As of the latest verification, thorswap-photon.pages.dev has been taken offline, but it remains a documented threat for historical reference.

Technical indicators confirm the malicious nature of thorswap-photon.pages.dev. The domain was flagged by 2 of 95 VirusTotal security vendors, including Fortinet and Trustwave. It appears on 2 security blocklists, PhishDestroy and ScamSniffer, and was registered through Cloudflare, Inc. on January 30, 2025. The domain resolves to the IP address 172.66.44.134, hosted by Cloudflare in the US (AS13335). The SSL certificate is issued by Google Trust Services / WE1, and the observed page title was 'Suspected phishing site | Cloudflare'. Technologies detected include HSTS, Cloudflare, and HTTP/3, with an HTTP status of 403 indicating restricted access.

Users who interacted with thorswap-photon.pages.dev should immediately revoke any token approvals granted to unknown or suspicious contracts using tools like Etherscan or Revoke.cash. Move remaining funds to a new, secure wallet and monitor transaction history for unauthorized activity. If credentials were entered, change passwords for all associated accounts and enable two-factor authentication (2FA). Report the phishing domain to platforms such as Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG) to aid in broader threat mitigation.