thornburg-tr[.]com

thornburg-tr.com was flagged as a generic phishing site under investigation for hosting a cryptocurrency drainer kit designed to steal digital assets from unsuspecting users. The domain mimics a legitimate investment firm, likely targeting victims under the pretense of offering high-yield financial opportunities. No specific brand or drainer kit signature has been publicly documented at this stage, but the site’s infrastructure suggests malicious intent aligned with common phishing-as-a-service operations.

Technical indicators confirm this domain as a high-risk threat. VirusTotal currently shows 1/95 detections, indicating it has evaded detection by most antivirus engines. The domain resolves to IP 172.67.175.242 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. It was created on April 16, 2026, and uses a valid SSL certificate from Let's Encrypt. Google Safe Browsing (GSB) has not yet flagged the domain, and no blocklist entries were detected in open-source threat intelligence feeds as of the latest scan.

The domain remains active and under active forensic review. Immediate actions include monitoring network traffic for connections to 172.67.175.242 and blocking the domain at the DNS or firewall level. While the current risk is categorized as 'under investigation,' the combination of recent creation, low detection rate, and drainer infrastructure suggests elevated risk to financial users. Security teams are advised to treat this domain as malicious until further evidence indicates otherwise, and users should refrain from engaging with any content hosted on thornburg-tr.com.