# tommyh123.biz — SUSPICIOUS

> tommyh123.biz hosts a credential harvesting phishing page mimicking a login portal. VirusTotal shows 0/95 detections. Check the full report.

## Summary
PhishDestroy identifies a credential harvesting domain, tommyh123.biz, that masquerades as a legitimate login interface to deceive users into surrendering sensitive credentials. This domain is currently active and under investigation for its role in phishing campaigns targeting unsuspecting individuals. The threat actor behind this domain leverages a deceptive naming convention to lend an air of legitimacy, likely aiming to harvest credentials for further exploitation in identity theft or unauthorized account access. Given the absence of detections on VirusTotal (0/95 engines) and the recent domain registration, this threat poses a significant risk to users who may interact with the fraudulent login page without proper scrutiny.  This domain was flagged by PhishDestroy after analysis revealed several key indicators of compromise. Registered on March 12, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, tommyh123.biz resolves to the IP address 188.114.96.3 and utilizes a Let's Encrypt SSL certificate to appear trustworthy. Notably, VirusTotal currently shows 0/95 detections, meaning no security vendors have flagged this domain as malicious at the time of writing. The domain’s recent creation and lack of historical data further complicate detection efforts, making it a stealthy threat vector. Users should exercise heightened caution when encountering this domain, as its credentials harvesting objective is likely to be deployed in spear-phishing campaigns or mass spam operations.  If users have visited tommyh123.biz or entered any credentials on the page, immediate action is required to mitigate potential risks. First, change passwords for any accounts that may have been exposed, prioritizing email, financial, and social media accounts. Enable multi-factor authentication (MFA) on all critical accounts to add an additional layer of security. Next, scan devices for malware or unauthorized access using reputable antivirus software, as threat actors often deploy additional payloads post-credential theft. Finally, report the domain to your organization’s security team or to platforms like PhishDestroy to aid in broader threat intelligence sharing. Staying vigilant and verifying the legitimacy of login portals before entering credentials is crucial to avoiding credential harvesting attacks.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2026-03-12 13:45:39
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 188.114.96.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/46f2ad03-80b4-40b5-a284-0858ab38b476
- PhishDestroy: https://phishdestroy.io/domain/tommyh123.biz/
- LLM endpoint: https://phishdestroy.io/domain/tommyh123.biz/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/tommyh123.biz/
Last updated: 2026-03-26