tcprosystem[.]co[.]th

The domain tcprosystem.co.th was registered through THNIC, indicating a Thai registration. DNS resolves to 147.50.231.19, an address owned by AS9891, CS LOXINFO Public Company Limited, confirming Thai hosting. The site presented a page title "TC PROSYSTEM 1994 CO.,LTD." and used a Let’s Encrypt R12 certificate, which is typical for legitimate sites but does not preclude abuse. Infrastructure analysis shows the web stack comprises Nginx serving a WordPress installation backed by MySQL and PHP, a common stack that attackers frequently compromise for phishing campaigns.

The HTTP response returned a 503 status, and the service is currently offline, which aligns with reports that the site has been taken down. Threat intelligence sources flag the domain: AlienVault OTX includes it in 19 separate pulses, PhishDestroy lists it as blocked, and VirusTotal records 14 detections out of 95 scanned engines, indicating moderate consensus of malicious activity. Additionally, the domain appears on one public blocklist, reinforcing its reputation as a threat. Nameservers ns1.tcprosystem.co.th, ns2.tcprosystem.co.th, th137.hostatom.com, and th138.hostatom.com are associated with the same hosting provider, further confirming the hosting footprint.

While the exact phishing lure or targeted brand is not disclosed in the available data, the combination of registrar, hosting, web technology, and multiple independent detections strongly suggests a phishing operation. Defenders should block the domain at perimeter firewalls, update URL filtering and DNS sinkhole lists, monitor for any outbound connections to the IP address, and consider adding the domain to internal blacklists. Continuous monitoring of OTX and other threat feeds is recommended to capture any resurgence or related campaigns.