thorchaon[.]org

Analysis of thorchaon.org confirms its classification as a high-risk phishing domain targeting THORChain users. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and remains active as of July 13, 2026. It resolves to IP address 188.114.96.3, with infrastructure leveraging Node.js, Express, and Cloudflare services, including HTTP/3 and Browser Insights. The page title explicitly displays 'THORChain,' indicating an attempt to impersonate the legitimate THORChain platform. The domain is flagged by 2 security blocklists and appears in 23 threat intelligence pulses on AlienVault OTX. Five of 95 security vendors on VirusTotal detect the domain as malicious. The SSL certificate is issued by Google Trust Services, a common but not exclusive indicator of legitimacy. No evidence of a phishing kit or additional brand impersonation is currently available in the provided data. Defenders should treat this domain as an active threat. Block resolution at the DNS level and monitor for connections to 188.114.96.3. Given the domain's persistence and targeting of cryptocurrency users, further investigation into associated wallet addresses or credential harvesting endpoints is recommended. The exact content and functionality of the site remain unanalyzed, but the combination of registration details, infrastructure, and detection metrics supports its classification as malicious.