app[.]thorwsap[.]finance

The domain app.thorwsap.finance is currently active and classified as a high‑risk generic phishing site. It was registered on February 21, 2026 through Tucows Domains Inc. and resolves to the IPv4 address 23.254.225.127, which is allocated to AS54290 Hostwinds LLC in the Netherlands. The site returns HTTP status code 200 and does not present an SSL/TLS certificate, exposing all traffic in clear text.

Infrastructure analysis shows the domain is served by three Njalla‑controlled name servers: 1-you.njalla.no, 2-can.njalla.in, and 3-get.njalla.fo. The page title returned by the web server is identical to the domain name, "app.thorwsap.finance," offering no legitimate branding or user‑facing content. Absence of HTTPS combined with a generic title suggests the site is intended solely to host credential‑stealing forms or redirect victims to malicious payloads.

Threat intelligence indicates the domain appears on two independent security blocklists—PhishDestroy and ScamSniffer—demonstrating that multiple monitoring services have observed phishing activity associated with this host. VirusTotal analysis flags the domain by 15 of 95 security vendors, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. No additional context such as phishing kit signatures or compromised credentials has been publicly disclosed.

Defenders should immediately block traffic to app.thorwsap.finance at perimeter and endpoint layers, and consider sinkholing the associated IP address to disrupt any ongoing credential collection. Continuous monitoring of DNS queries for the three Njalla name servers is advised, as changes may indicate redeployment of the phishing infrastructure. While the current evidence confirms phishing intent, the specific victim targeting and payload delivery mechanisms remain uncertain and warrant further investigation through sandbox or network traffic analysis should any connections be observed.