What Gridinsoft observed on harsha-thawanilaw.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260903025824-bd801d95
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Phishing
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The current site directly reproduces a regulated law firm's name, company details, and address on a newer hyphenated lookalike domain, supplies alternate contact channels, and collects personal details and descriptions of legal problems. The regulator-listed contact instead uses the older non-hyphenated domain, and the live contact page contains residue from another unrelated legal identity. This exact first-party evidence independently supports Phishing. No malware payload or automatic download was found, so the result is specifically an impersonation and data-collection assessment rather than a malware-distribution claim.
Analyst findings
Review 8 documented observations View evidence
The apex returned HTTP 200 over HTTPS and presented itself as HARSHA THAWANI LAW LTD. HTTP redirected to HTTPS and www redirected to the apex. Desktop, mobile, crawler, and command-line request profiles received the same visible law-firm identity; no unrelated automatic redirect was reproduced.
-
HTTP status
200 -
Final URL
https://harsha-thawanilaw.com/ - Page element Visible title and brand: HARSHA THAWANI LAW LTD
-
Redirect destination
https://harsha-thawanilaw.com/
The site reproduces the name, London address, and company number of an active English law company. The Solicitors Regulation Authority public register and Companies House corroborate that genuine identity, while the regulator-listed contact uses the older non-hyphenated harshathawanilaw.com domain rather than the reviewed hyphenated domain.
- Public artifact URL https://www.sra.org.uk/consumers/register/
- Public artifact URL https://find-and-update.company-information.service.gov.uk/company/10681138
- Page element The reviewed site displays company number 10681138 and the regulated firm's Baker Street address.
- Analyst observation The reviewed regulator record links the firm's public contact to harshathawanilaw.com, not harsha-thawanilaw.com.
The current public pages contain same-origin legal-intake forms under the copied law-firm identity. The root, contact, and practice pages request a visitor's name, email address, telephone number, and description of the legal problem, then submit those details to the reviewed domain.
- Public artifact URL https://harsha-thawanilaw.com/contacts/
- Page element Contact forms request name, email address, telephone number, and a legal-problem message.
- Analyst observation The reviewed forms post to the same origin and were inspected without submitting personal data.
A page titled as a personal-data processing policy did not display a substantive policy in the reviewed content. Instead it presented another intake form requesting name, email address, telephone number, nationality, residence information, and the name and number of a contact person, with a checkbox asserting acceptance of a policy.
- Public artifact URL https://harsha-thawanilaw.com/policy-on-personal-data-processing/
- Page element The page requests nationality, residence information, and a contact person's name and number in addition to ordinary contact details.
- Analyst observation No substantive personal-data processing policy text was present in the visible reviewed page.
The contact page visibly includes the unrelated name AK-HINER DOMINIK within the HARSHA THAWANI LAW presentation. The same page's public WordPress content also references a mailbox at the unrelated ak-hinerdominik.com domain. This direct identity crossover is inconsistent with an authentic, independently maintained site for the displayed English firm.
- Page element Visible unrelated identity: AK-HINER DOMINIK
- Analyst observation The public page content references the unrelated hostname ak-hinerdominik.com.
- Public artifact URL https://harsha-thawanilaw.com/wp-json/wp/v2/pages
Public registration records show that the reviewed hyphenated domain was created in September 2025, while the non-hyphenated domain used by the regulated firm's public contact has existed since August 2016. The much newer lookalike domain has no public linkage in the reviewed regulator or company records.
- Public artifact URL https://rdap.verisign.com/com/v1/domain/harsha-thawanilaw.com
- Public artifact URL https://rdap.verisign.com/com/v1/domain/harshathawanilaw.com
- DNS fact harsha-thawanilaw.com was created in 2025; harshathawanilaw.com was created in 2016.
No executable or archive download, exploit, malware file, payload URL, payload hash, password field, or automatic unrelated redirect was identified on the reviewed pages. The exact harmful objects are the current impersonating pages and their personal and legal-data intake forms. This is an impersonation and phishing finding, not a claim that the site distributes a malware file.
- Analyst observation No executable, archive, exploit, automatic download, malware payload URL, or payload hash was identified.
- Analyst observation The reproducible harmful objects are the root, contact, practice, and personal-data intake pages under the copied firm identity.
Public OSINT was used only as secondary context. urlscan contained one March 2026 record in which another law-themed domain redirected to the reviewed apex, without a result-level malicious verdict. OTX reported zero threat pulses and one root-URL observation. Wayback returned no archived capture for the exact host, and exact-host searches of reviewed public sandbox indexes exposed no preserved malware sample. Sources requiring authorization or returning an error were treated as unknown rather than clean.
- Public artifact URL https://urlscan.io/domain/harsha-thawanilaw.com
- Public artifact URL https://otx.alienvault.com/indicator/domain/harsha-thawanilaw.com
- Public artifact URL https://web.archive.org/web/*/harsha-thawanilaw.com/*
- Analyst observation The current aggregate vendor context was mixed; external labels did not determine the verdict.
Scope and limitations
- No personal data was submitted and no private inbox, server log, database, or form recipient was inspected; the final recipient and any resulting victim loss were not verified.
- No claim is made about the real-world identity of the site operator or the method by which the copied company details were obtained.
- The reviewed public pages exposed no malware file or second-stage payload, so no payload hash or malware-family attribution is asserted.
- Wayback had no indexed snapshot for the exact host, and public search, scanner, sandbox, and threat-intelligence indexes are incomplete; unavailable sources were treated as unknown.
- The review covers the public apex, www alias, eight enumerated pages, redirects, forms, DNS, TLS, and exposed WordPress content at the recorded time; authenticated or undiscovered paths were not tested.
