thana[.]finance

This domain, thana.finance, was registered on 16 September 2025 through Devexpanse Ltd d/b/a Regery.com. The authoritative name servers are sandra.ns.cloudflare.com and venkat.ns.cloudflare.com, indicating the use of Cloudflare DNS services. DNS resolution points to IP address 82.25.81.58, which is announced by AS47583 belonging to Hostinger International Limited and geolocated to the United States. No TLS certificate is presented, so all HTTP traffic would be unencrypted. An HTTP request to the root URL returns a 409 Conflict page title, suggesting the site is no longer serving legitimate content.

The domain is currently listed as offline in the intelligence feed. Security telemetry shows that PhishDestroy has blocked the domain, and it appears on a single security blocklist. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high likelihood of malicious use. VirusTotal analysis records two detections out of ninety‑five scanners, confirming that at least a minority of AV engines flag the domain as malicious.

The overall risk rating is elevated. Evidence gaps remain: the exact phishing payload, targeted brand, or credential‑harvesting page have not been captured, and no SSL certificate prevents verification of potential certificate‑pinning techniques. Consequently, defenders should continue to deny any network connections to thana.finance, add the domain to local blocklists, and monitor for any future re‑registration or infrastructure changes. Ongoing observation of the associated IP range and Cloudflare name servers is advised to catch possible reuse.