app[.]home-thor[.]net

PhishDestroy identifies app.home-thor.net as an active phishing domain classified under 'generic_phishing' using a seed of d67598. This domain masquerades as a legitimate application portal, specifically targeting users with a fake 'Home Thor' interface designed to harvest credentials and sensitive data. No known brand impersonation or drainer kit has been explicitly linked to this domain at this stage, but its structure and recent creation suggest a high potential for malicious intent as it evolves. The domain’s behavior remains under close observation as analysts determine the full scope of its operations.

This domain was flagged and is currently under investigation, with exact technical indicators as follows: it was created on December 07, 2025, resolves to the IP address 104.21.21.100, and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain holds a valid SSL certificate issued by Google Trust Services, which may lend it an air of legitimacy to unsuspecting users. As of the latest scan, VirusTotal reports 0 detections out of 95 engines, indicating that traditional antivirus and security tools have not yet flagged its malicious activities. This low detection rate increases the risk of successful compromise for visitors, particularly those unfamiliar with the signs of phishing. There is no current evidence of inclusion on major blocklists such as Google Safe Browsing (GSB), which further highlights its emerging threat status.

Currently, the domain remains active and poses an under-investigation risk as classified by security researchers. Immediate response actions include heightened monitoring by cybersecurity teams and the dissemination of awareness to potential targets. The remaining risk is assessed as moderate due to the domain’s recent creation and low detection rates, which suggest it may be in an early deployment phase. Users are strongly advised to avoid interacting with app.home-thor.net and to verify the authenticity of any 'Home Thor' related applications through official channels. Security teams should consider preemptive blocking of the domain and IP address at the network level to mitigate potential infiltration. Further updates will be provided as the investigation progresses and more intelligence becomes available.