thorcuain[.]org

Analysis indicates that the domain thorcuain.org was registered on February 21, 2026 through NiceNIC International Group Co., Limited. The site presents a page title of “THORChain” and returns HTTP 200 responses. Infrastructure inspection shows the domain resolves to IP 188.114.97.3, which belongs to AS13335 Cloudflare, Inc., located in the United States. DNS resolution is handled by the Cloudflare nameservers arely.ns.cloudflare.com and matteo.ns.cloudflare.com, and the site serves a TLS certificate issued by Google Trust Services under the WE1 designation, confirming use of standard HTTPS. Threat intelligence flags the domain as a high‑risk brand‑impersonation targeting the Avalanche brand. The page title does not reference Avalanche, but the domain is listed as impersonating that brand in the provided intelligence. VirusTotal scans have identified the domain as malicious in three of ninety‑three vendor engines, and the domain appears on at least one public blocklist. Additional reputation data shows a Gridinsoft trust score of zero out of one hundred, and the domain has been blocked by the PhishDestroy mitigation service. Technical profiling reveals a Node.js application served via the Express framework, with traffic accelerated through Cloudflare and HTTP/3 support. No further payload or content analysis is available, and the exact phishing vector remains unconfirmed. Defenders should add thorcuain.org to URL filtering and endpoint allow‑list exclusions, monitor DNS queries for the associated IP and nameservers, and enforce TLS inspection to capture any downstream malicious payloads. Continuous re‑scanning with multi‑vendor services is recommended to capture any changes in detection status.