thorvhain[.]org

This domain, thorvhain.org, is flagged as a crypto credential theft site specifically targeting THORChain users. Analysis of the page title and infrastructure reveals an attempt to impersonate the legitimate THORChain decentralized exchange platform, likely aiming to harvest wallet credentials or private keys from unsuspecting users. No drainer kit signatures were detected in the initial scan, but the domain's structure and branding align with known credential theft campaigns in the cryptocurrency sector. Infrastructure analysis reveals the following technical indicators: the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and currently resolves to IP address 172.67.132.104. At the time of assessment, VirusTotal reported 0/95 detections, indicating no antivirus engines had flagged the domain as malicious. The domain appears on one security blocklist and is protected by an SSL certificate issued by Google Trust Services. Detected technologies include Node.js, Express, Cloudflare Browser Insights, Cloudflare, and HTTP/3, suggesting a modern, obfuscated hosting setup designed to evade detection. The domain has been taken offline, likely in response to security interventions or automated takedown processes. Despite its current offline status, the infrastructure remains a potential risk due to its recent registration date (future-dated, possibly indicative of bulk registration for malicious use) and the use of Cloudflare to mask origin servers. Users who interacted with thorvhain.org prior to takedown should assume credential compromise and take immediate action: revoke any connected wallet sessions, monitor for unauthorized transactions, and rotate private keys if exposure is suspected. Continuous monitoring of related domains registered through the same registrar is recommended, as threat actors often re-deploy infrastructure under similar naming conventions.