tjorchain[.]org

The domain tjorchain.org is currently under investigation for potential brand impersonation, a specific type of generic phishing. This domain, which resolves to the IP address 188.114.96.3, has been taken offline and is not currently active. The risk level is assessed as under investigation due to the nature of the threat and the limited amount of available data.

Infrastructure analysis reveals that tjorchain.org appeared on one security blocklist, PhishDestroy, and has a Gridinsoft trust score of 0/100. The domain was created on February 21, 2026, and is registered through NiceNIC International Group Co., Limited. Despite being flagged, VirusTotal reports 0/95 detections, indicating that the domain has not been identified by major antivirus engines. The SSL certificate is issued by Let's Encrypt, and the technologies detected include Node.js, Express, and Cloudflare services such as Cloudflare Browser Insights and HTTP/3. The page title associated with the domain is THORChain, suggesting an attempt to impersonate the legitimate THORChain project.

To mitigate the risks associated with brand impersonation, users are advised to verify the authenticity of any communication or website claiming to be related to THORChain. This can be done by cross-referencing the domain and IP address with official THORChain resources and known trusted endpoints. Additionally, implementing DNS-based security measures such as DNSSEC and DMARC can help prevent unauthorized use of the THORChain brand. Organizations should also monitor for and block any suspicious traffic to this domain using their firewall and network security solutions. Educating employees and users about the signs of brand impersonation and encouraging them to report any suspicious activity can further enhance security.