grekes[.]icu

PhishDestroy identifies grekes.icu as a recently activated domain engaged in a deceptive login page phishing campaign, targeting unsuspecting users under the guise of legitimate authentication. The domain, registered on April 01, 2026, resolves to IP 104.21.89.123 and leverages a Google Trust Services SSL certificate to enhance credibility. No known brand impersonation or drainer kit has been observed in this campaign as of initial assessment, but the infrastructure suggests a high potential for credential harvesting and subsequent unauthorized access.

This domain was flagged under investigation with zero detections on VirusTotal (12/95 engines) as of the latest scan. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar often associated with high-volume, low-friction domain registrations that may facilitate malicious activities. The SSL certificate issued by Google Trust Services adds a layer of legitimacy, potentially tricking users into believing the domain is trustworthy. The domain’s creation date of April 01, 2026, is suspiciously recent, aligning with an active phishing campaign timeline. Current blocklist status remains unconfirmed, indicating no prior mitigation efforts have been widely implemented.

The status of this campaign is currently active, with no confirmed takedown or mitigation measures in place as indicated by the zero VirusTotal detections. PhishDestroy recommends immediate blocking of the domain grekes.icu and the associated IP address 104.21.89.123 at the network perimeter to prevent user exposure. Users should exercise extreme caution when encountering this domain, particularly in login prompts, and verify the legitimacy of any requests through independent channels. The remaining risk is high due to the domain’s recent activation, lack of detections, and the use of a trusted SSL certificate, which collectively increase the likelihood of successful phishing engagement. Proactive monitoring and sharing of intelligence with threat intelligence platforms are strongly advised to accelerate detection and mitigation efforts.