thomphon[.]com

Analysis of the domain thomphon.com, observed on 29 July 2026, indicates active phishing infrastructure. The domain was registered on 10 April 2026 through Web Commerce Communications Limited dba WebNic.cc. DNS resolution points to the IP address 172.67.223.84, which is associated with a cloud hosting provider commonly leveraged for malicious campaigns. The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy sinkhole, confirming its malicious intent.

VirusTotal reports that 22 of 91 scanned security vendors flag the domain as malicious, providing a moderate consensus of compromise. The presence of multiple detections across independent scanners reinforces the likelihood that the site hosts credential‑harvesting or fraudulent content. No additional intelligence such as page title, SSL certificate details, or HTTP response codes is currently available, leaving the exact phishing payload and targeted brand unspecified.

Defenders should update perimeter defenses to block the domain and associated IP, enforce DNS‑based filtering, and monitor for any outbound connections to the host. Incident response teams should treat any traffic to thomphon.com as malicious and consider quarantine of compromised credentials. Ongoing observation is recommended to capture any evolution of the infrastructure, including potential deployment of additional hosting or changes in detection status.