thorr-chain-wallet[.]pages[.]dev

PhishDestroy identifies the domain thorr-chain-wallet.pages.dev as an active crypto_drainer threat under ongoing investigation. This deceptive site masquerades as a cryptocurrency wallet service, explicitly designed to steal digital assets from unsuspecting users by tricking them into connecting their wallets and authorizing fraudulent transactions.

This domain was flagged by 4 out of 95 VirusTotal vendors, indicating it currently evades broad detection engines. It was registered through Cloudflare, Inc., resolves to IP 188.114.97.3, and holds an SSL certificate issued by Google Trust Services, which enhances its appearance of legitimacy. At the time of analysis, the domain had not been added to any major threat intelligence blocklists.

Given the current status of this crypto_drainer as active and undetected by standard scanning tools, PhishDestroy recommends immediate caution when encountering any links or advertisements related to thorr-chain-wallet.pages.dev. Users should avoid interacting with this domain or any associated web pages. Website administrators and security teams are advised to block 188.114.97.3 and monitor for outbound connections to this IP. Security solutions should integrate threat intelligence feeds to preemptively identify similar patterns, particularly those using Cloudflare-hosted infrastructure and Google-issued SSL certificates to evade detection. Blocklisting by domain and IP is strongly recommended to prevent exposure within organizational and personal networks.