financialholders[.]live

This domain, financialholders.live, is currently flagged as a high-risk generic phishing site. Analysis indicates it was registered on February 21, 2026, through NiceNIC International Group Co., Limited and remains active as of July 25, 2026. Infrastructure analysis reveals the domain is hosted behind Cloudflare, using nameservers josh.ns.cloudflare.com and emma.ns.cloudflare.com, and resolves to the IP address 188.114.96.3, which belongs to AS13335 (Cloudflare, Inc.) in the United States. The site returns an HTTP 403 status, suggesting access restrictions or protective measures, and presents a page title of 'Just a moment...', a common indicator of Cloudflare's interstitial challenge page.

The domain is detected by 2 of 93 security vendors on VirusTotal, though this alone does not confirm malicious intent without further context. It appears on one security blocklist, specifically PhishDestroy, and has a Gridinsoft trust score of 0/100, reinforcing its suspicious classification. The SSL certificate is issued by Google Trust Services (WE1), which is standard for Cloudflare-protected domains and does not provide additional risk signals. Technologies detected include Cloudflare Browser Insights and HTTP/3, consistent with Cloudflare's infrastructure.

While the domain's exact content and target brand remain unconfirmed, its registration details, hosting behind Cloudflare, and presence on security blocklists align with known phishing infrastructure patterns. Defenders should treat this domain as malicious and implement blocking measures at the network and endpoint levels. Further investigation into associated URLs, email campaigns, or redirect chains is recommended to identify any broader threat clusters. Given the lack of definitive brand impersonation in the available data, the site should be classified as a generic phishing domain until additional evidence emerges.