v2-thorchain[.]net

Analysis of v2-thorchain.net indicates a brand‑impersonation campaign targeting Thorchain users. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure (IP 104.21.112.1, AS13335, United States). The TLS certificate is issued by Google Trust Services under the WE1 root, confirming the site served HTTPS traffic before being taken offline. DNS is delegated to april.ns.cloudflare.com and kayden.ns.cloudflare.com, both Cloudflare name servers, which is consistent with the observed IP address. The page title retrieved during the brief scan matches the official Thorchain branding (“Thorchain — Cross‑Chain Liquidity Protocol & RUNE Crypto Asset | Thorchain Network”), reinforcing the impersonation intent.

The domain appears on three public security blocklists and has been flagged by the PhishDestroy, MetaMask, and SEAL blocklist providers. VirusTotal analysis shows four of ninety‑three AV engines flagged the domain, indicating a modest but non‑trivial detection rate. Current status is offline, which limits immediate observation of payloads or credential‑harvesting forms, and no additional content has been captured. Consequently, the exact phishing vector (e.g., login page, malicious download) remains unknown.

Defenders should continue to monitor the domain for any re‑activation and ensure that any outbound connections to the associated IP address are logged. Blocklist updates should incorporate the domain and its associated IP, and security appliances should be configured to deny TLS connections to the certificate fingerprint. Incident response teams should advise users of Thorchain to verify URLs and avoid entering credentials on any site that does not belong to the official thorchain.com domain. Threat intelligence feeds should be updated with the registrar, creation date, and the observed nameserver pair to aid correlation with future campaigns that reuse similar infrastructure.