tharwafinancereward[.]live

This domain, tharwafinancereward.live, was registered on July 17 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolving to the IP address 104.21.39.227. The authoritative nameservers igor.ns.cloudflare.com and peaches.ns.cloudflare.com indicate that the domain is hosted behind Cloudflare’s CDN, a common choice for threat actors seeking to obscure the true origin of malicious infrastructure. Within three days of creation the domain appeared on a security blocklist and is actively blocked by the PhishDestroy feed, reflecting early detection by at‑least one phishing‑prevention service. VirusTotal records show that the domain has been scanned by 91 antivirus and URL‑reputation vendors, none of which reported a detection at the time of analysis; the lack of a positive verdict does not imply benign intent, especially given the domain’s classification as a generic phishing campaign. The current operational status is listed as active and the risk level remains under investigation pending further evidence. Open questions include the specific lure employed, the credential‑stealing page content, and any associated command‑and‑control endpoints, all of which have not yet been disclosed publicly. Defenders should add tharwafinancereward.live to deny‑list or firewall rules, monitor DNS queries for the domain and its Cloudflare nameservers, and enable heuristic URL filtering that flags newly registered domains with similar characteristics. Continuous re‑evaluation is advised as additional telemetry, such as sandbox submissions or user reports, may surface new indicators of compromise.