# thena.vip — SUSPICIOUS

> thena.vip flagged for credential harvesting. Only 0 of 95 VirusTotal vendors detected it. Check the full report.

## Summary
PhishDestroy identifies thena.vip as a credential harvesting domain currently active and under investigation. This domain is being tracked for malicious activity associated with phishing campaigns targeting unsuspecting users.


This domain, thena.vip, has been flagged by 0 of 95 VirusTotal vendors as of the latest scan, indicating a significant detection gap. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 188.114.96.3. It utilizes a Let's Encrypt SSL certificate, providing a veneer of legitimacy. Registered on March 17, 2026, this domain is notably fresh, which may explain why it has not yet been widely flagged or added to blocklists. Current trust scores and blocklist counts remain unavailable due to its recent creation, further highlighting the urgency of proactive monitoring.


Given the domain's active status and the absence of detections despite its malicious nature, immediate action is warranted. Organizations and users are advised to block thena.vip at the network perimeter and DNS level to prevent potential credential theft. Regular monitoring of network traffic for connections to this domain is strongly recommended. Users should exercise extreme caution when encountering links or advertisements promoting thena.vip, as it is designed to harvest sensitive login credentials. Additionally, reporting this domain to threat intelligence platforms and updating security tools with its indicators of compromise will enhance collective defense mechanisms. Proactive measures, including user awareness training on recognizing phishing attempts, are critical to mitigating the risk posed by this emerging threat.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2026-03-17 23:54:55
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 188.114.96.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/bd6a3c39-e2af-4ecf-8238-c1cfbc6dbdf8
- PhishDestroy: https://phishdestroy.io/domain/thena.vip/
- LLM endpoint: https://phishdestroy.io/domain/thena.vip/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/thena.vip/
Last updated: 2026-03-22