# PhishDestroy threat dossier — grafsynergy.com ================================================================ Fetched: 2026-07-30 10:57:21 UTC Canonical: https://phishdestroy.io/domain/grafsynergy.com/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 7/91 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, BitDefender, CRDF, Fortinet, G-Data, Kaspersky AlienVault OTX: 4 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 63.182.102.222 (DE, Frankfurt am Main) ASN: AS16509 Amazon.com, Inc. Hosting org: AWS EC2 (eu-central-1) Registrar: Register SPA Nameservers: ["ns1.register.it", "ns2.register.it"] Page title: Macchine e Soluzioni per la Produzione di Infissi in PVC HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R13 Expires: 2026-08-26 Status: INVALID chain Fingerprint: 18490498f5561d11a63b8937dd599bbf26f9749116a53618b142385a0ceafeff Subject Alternative Names (related infrastructure — often same operator): - www.grafsynergy.com ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-26 09:33:08 UTC (by PhishDestroy tracker) Last verified: 2026-07-30 12:20:30 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-26 09:34:22 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] grafsynergy.com: Confirmed Phishing Site On July 26, 2026, the domain grafsynergy.com was identified as a high‑risk generic phishing infrastructure. The site returns HTTP 200, indicating an active web service, and is presently listed on a security blocklist. VirusTotal analysis shows that 7 of 91 scanning engines have flagged the domain, confirming malicious intent. The domain is actively blocked by the PhishDestroy feed, reinforcing its classification as a phishing resource. Registration data reveals that grafsynergy.com was created through Register SPA and utilizes the authoritative nameservers ns1.register.it and ns2.register.it, both associated with the Italian registrar Register.it. No further hosting details such as IP address or ASN are disclosed in the available intelligence. The domain remains active at the time of analysis, suggesting ongoing operation. The high risk rating aligns with the observed detection metrics and the active status of the domain. Because the domain resolves to the registrar's default name servers, it is likely hosted on infrastructure controlled by the registrar, which may simplify takedown efforts. No SSL certificate details, page title, or brand references have been disclosed, limiting content‑specific analysis. However, the combination of blocklist inclusion, multi‑vendor detections, and active HTTP response provides sufficient evidence for remediation. Defenders should add grafsynergy.com to local deny lists, enforce DNS‑level blocking, and monitor outbound traffic for connections to the associated nameservers. Continuous re‑scanning with multi‑engine services is recommended to capture any changes in detection status. Security teams should also consider sharing indicators of compromise with threat‑intel sharing platforms to aid broader community defense. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 536e761bdbaa45ac8b125c7301efa96e TLS cert SHA-256: 18490498f5561d11a63b8937dd599bbf26f9749116a53618b142385a0ceafeff ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/grafsynergy.com/ JSON API: https://api.destroy.tools/v1/check?domain=grafsynergy.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 195,594 domains (83,321 alive under monitoring, 110,013 confirmed takedowns/dead). Site: https://phishdestroy.io