ngemgrlhmdqi3zsgscjgjrdwpietxf3kbwjfzrarb4h6f3nimjsiu7yd[.]top

The domain ngemgrlhmdqi3zsgscjgjrdwpietxf3kbwjfzrarb4h6f3nimjsiu7yd.top was identified as a generic phishing threat, impersonating the TorZon brand. The site displayed a fake access queue page designed to harvest credentials or other sensitive information from unsuspecting users. No specific drainer kit was associated with this campaign, but the threat type is consistent with credential phishing targeting cryptocurrency service users.

Technical analysis reveals that the domain was registered through the registrar 耐思尼克国际集团有限公司 and was created on May 26, 2026. VirusTotal data shows that 7 out of 95 security vendors flagged this domain as malicious, indicating a moderate but not overwhelming detection rate. AlienVault OTX found the domain in four threat intelligence pulses, and it appears on one security blocklist. The domain was also flagged by Google Safe Browsing, contributing to its elevated risk level. The IP address associated with the domain was not provided in the intelligence, but the registration details suggest a likely hosting in Asia.

As of the latest analysis, the domain has been taken offline, reducing the immediate threat to users. However, the remaining risk is that similar domains may be created by the same threat actors, as phishing campaigns often rotate domains. Users who encountered this site should be cautious of any unsolicited access queue pages and verify the legitimacy of TorZon services through official channels. PhishDestroy recommends monitoring for related domains and using security tools to block such threats proactively.