xn--rbb-6cd1h[.]xn--ismlsaft-k4dd464auubea1m3b1t[.]handy[.]gr[.]com

This domain, handy.gr.com, is currently flagged as an active generic phishing threat under investigation as of July 12, 2026. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Key-Systems GmbH and is hosted behind Cloudflare, resolving to IP address 104.21.17.117 (AS13335, United States). The site returns an HTTP 521 status with the page title 'handy.gr.com | 521: Web server is down,' indicating the origin server may be intentionally offline or misconfigured. SSL is provided by Let's Encrypt (E8 certificate), and the domain appears on one security blocklist (PhishDestroy). No phishing kit or targeted brand has been identified in available data, and the exact content of the site remains unanalyzed. Defenders should treat this domain as potentially malicious infrastructure, monitor for reactivation, and consider blocking or sinkholing traffic to the resolved IP until further classification is available.