thornburgb[.]com

PhishDestroy identifies thornburgb.com as an active crypto drainer phishing domain impersonating Thornburg Investment Management, a well-known financial services brand. The domain is currently classified as elevated risk and remains active as of the latest investigation cycle. Security analysts have observed this infrastructure being used to deceive users into connecting cryptocurrency wallets under false pretenses, typically through fake investment portals or fraudulent onboarding flows designed to trigger unauthorized token transfers via malicious smart contract interactions. This campaign poses a direct financial threat to users engaging with cryptocurrency platforms and should be treated with high urgency.

This domain was registered on April 27, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to IP address 89.124.115.204. According to VirusTotal telemetry, thornburgb.com is flagged by 1 of 95 security vendors. The domain utilizes a Let's Encrypt SSL certificate, indicating an attempt to appear legitimate. While blocklist presence is minimal at present, the recency of domain registration combined with the observed threat type suggests an emerging campaign with potential for rapid expansion. Trust scores remain low across multiple threat intelligence feeds, reinforcing the elevated risk classification.

Current status indicates an active campaign with live infrastructure and potential user targeting via email, social media, or fake investment forums. Given the domain's recent creation and low detection coverage, the risk of exposure to inexperienced or high-value targets (e.g., crypto investors) is significant. PhishDestroy recommends immediate network-level blocking of both the domain and associated IP address 89.124.115.204. Users should verify any financial or investment-related URL against PhishDestroy’s real-time database before interaction. Additionally, cryptocurrency users should inspect wallet connection requests for suspicious domains and revoke permissions for unknown contracts. Organizations are advised to update firewall rules, DNS filters, and security awareness training to include warnings about fake investment platforms leveraging recently registered domains.