thvip12[.]net

Analysis of the domain thvip12.net indicates it is an active phishing site targeting Thai-language users, likely impersonating an electricity billing portal. The domain was registered on February 21, 2026, through NameCheap, Inc., and currently resolves to Cloudflare IP 104.21.12.138 (AS13335). Infrastructure analysis reveals Cloudflare nameservers (collins.ns.cloudflare.com, luke.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1), consistent with many phishing campaigns leveraging Cloudflare for anonymity and SSL legitimacy. The page title 'หน้าแรกกกฟหกด' translates to 'Home PEA' or 'Home Provincial Electricity Authority,' suggesting the site mimics Thailand's state electricity provider. While the exact content and functionality remain unconfirmed, the title strongly implies a billing or payment scam targeting Thai consumers.

Detection data shows the domain is blocked by PhishDestroy, MetaMask, and SEAL, and appears on three security blocklists. Gridinsoft assigns a trust score of 0/100, reinforcing its malicious classification. Two of 93 security vendors on VirusTotal flag thvip12.net as malicious, though this detection rate is low and may reflect limited scanning coverage rather than benign status. The site returns an HTTP 200 status, indicating it is operational and serving content. Technologies detected include WordPress, MySQL, PHP, jQuery, and Cloudflare Browser Insights, a common stack for phishing sites due to its ease of deployment.

Defenders should treat thvip12.net as high-risk infrastructure. Network-level blocking is recommended, particularly for organizations with users in Thailand or Southeast Asia. Given the domain's recent registration and Cloudflare hosting, monitoring for newly created sister domains with similar naming patterns (e.g., 'vip' or numeric sequences) may help preempt related campaigns.