# PhishDestroy domain threat record: graystonecoinhub.live

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/graystonecoinhub.live/
Machine-readable companion: https://phishdestroy.io/domain/graystonecoinhub.live/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-25 08:58:50 UTC
- Last availability or vendor check: 2026-10-25 12:23:06 UTC
- Stored record updated: 2026-10-25 12:23:06 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 216.198.79.1
- Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED
- Last stored HTTP status: 308
- Registration date in stored WHOIS data: 2026-10-21 10:49:15 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17247-0ec6-7549-937c-aa5dd73cfae7/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/graystonecoinhub.live
- Certificate Transparency search: https://crt.sh/?q=%25.graystonecoinhub.live
- Web Archive lookup: https://web.archive.org/web/*/https://graystonecoinhub.live/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake flagged the site as malicious because an admin report noted the domain was only three days old and an AI model assigned a high phishing confidence. The domain was first seen by PhishDestroy on 2026-10-25, four days after its registration on 2026-10-21, and the HTTP response at that time was a 308 redirect to the www subdomain followed by a 200 OK. The recorded page title reads “Graystone | Trading Platform” and the meta description describes it as a trading and portfolio platform.

How the scam works
Fake trading platforms lure visitors by promising easy, high‑return opportunities in Forex, cryptocurrency, commodities or indices, then request deposits or personal data to unlock the promised profits. No genuine exchange or brokerage infrastructure exists, so any funds or credentials provided are lost or abused.

Evidence
VirusTotal scanned the domain on 2026-10-25 with 92 engines and reported zero malicious or suspicious detections. Google Safe Browsing checked the same day and did not flag the site. OTX listed four pulses referencing the domain on 2026-10-25. URLScan’s machine‑learning engine marked the page malicious with a score of 96, although its overall verdict was non‑malicious. PhishDestroy’s internal blocklist contains graystonecoinhub.live, while external blocklists returned no matches.

Infrastructure
The domain was registered with NICENIC INTERNATIONAL GROUP CO., LIMITED on 2026-10-21. DNS records at the time pointed to an A record of 216.198.79.1 and a CNAME to Vercel’s DNS service; the page fetch also recorded the IP 66.33.60.130 belonging to Amazon ASN 16509. TLS was provided by Let’s Encrypt, issued on 2026-10-21 and valid until 2027-01-19, and the response included a strict‑transport‑security header with a two‑year max‑age.

What to do
Visitors should avoid entering credentials, financial information or deposits on the site; if they have already done so, they should change any used passwords and monitor accounts for unauthorized activity. Defenders should add graystonecoinhub.live to blocklists and threat‑intel feeds and review network logs for connections to this exact domain or the recorded IP addresses.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17247-0ec6-7549-937c-aa5dd73cfae7/
Cloudflare Radar report: https://radar.cloudflare.com/scan/972a6f1c-6fcf-43c1-8bcc-d2bb678651a1
Stored capture screenshot: https://i.ibb.co/Txj3bpXG/6b08c36b66cc.png
Cloudflare Radar screenshot (2026-10-25T09:38:27Z): https://screenshots.phishdestroy.io/cf/972a6f1c-6fcf-43c1-8bcc-d2bb678651a1.png
URLScan screenshot (2026-10-25T08:56:41Z): https://screenshots.phishdestroy.io/us/01a17246-9d72-7735-9ae1-dac2593df071.png
URLScan capture report: https://urlscan.io/result/01a17246-9d72-7735-9ae1-dac2593df071/
VirusTotal report: https://www.virustotal.com/gui/domain/graystonecoinhub.live
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=graystonecoinhub.live
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-25 09:42:20 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/Txj3bpXG/6b08c36b66cc.png
  Captured: 2026-10-25 08:58:50 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a17247-0ec6-7549-937c-aa5dd73cfae7.png
  Captured: 2026-10-25 08:58:50 UTC
  Source report: https://urlscan.io/result/01a17247-0ec6-7549-937c-aa5dd73cfae7/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/972a6f1c-6fcf-43c1-8bcc-d2bb678651a1.png
  Captured: 2026-10-25 09:38:27 UTC
  Source report: https://radar.cloudflare.com/scan/972a6f1c-6fcf-43c1-8bcc-d2bb678651a1
  SHA-256: 74dc8527fe7975a052fe573ca481b25e5515d490798dfe0dd9d1ffb5de6bb337
- URLQuery: https://screenshots.phishdestroy.io/uq/a237ff8c-9fd8-4fef-a101-83c4b28a5e46.png
  Source report: https://urlquery.net/report/a237ff8c-9fd8-4fef-a101-83c4b28a5e46
  SHA-256: 0082ba8620a4734c38f0a93fa93f033d9dd4d15d7997113db36f26bd1f784cdf
- URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a17246-9d72-7735-9ae1-dac2593df071.png
  Captured: 2026-10-25 08:56:41 UTC
  Source report: https://urlscan.io/result/01a17246-9d72-7735-9ae1-dac2593df071/
  SHA-256: 75a6e92613cd918e403520ccfe1d85c9c069c31257f837eb5a4f5ab717ba4c30

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-25T09:16:33Z",
        "uuid": "01a17247-0ec6-7549-937c-aa5dd73cfae7",
        "scanned_at": "2026-10-25T08:57:08Z",
        "final_url": "https://www.graystonecoinhub.live/",
        "status": 200,
        "redirected": "parent-domain",
        "redirects": [
            {
                "to": "https://www.graystonecoinhub.live/",
                "from": "https://graystonecoinhub.live/",
                "status": 308
            }
        ],
        "ip": "66.33.60.130",
        "domains": [
            "graystonecoinhub.live"
        ],
        "ips": [
            "66.33.60.130",
            "216.198.79.1"
        ],
        "asns": [
            "16509"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "ef225f3fe03fa6eedce10698cb424f79c7edf2063cb4d2407ee3e1400e19aca8",
        "script_hashes": [
            "12a8e2dafd33b256a3acb33a3f0668e3b2fe01987321deaed6eae11c9106348d",
            "e92e1647b626d2be449d03b6d74cb5cbb373f37a23008d4dd2525b53ac033a8a",
            "d96f03eceb3fb202635ed046e65c28b98e7764c4b1e3f10c44c84fa8fcbd8b85",
            "f570f010403dac238cd53171d6392deec874d0ce3818a17f1fd21580221a5496",
            "8bbb58cbfd4633c1d828c6bc37bc32abc768a149c01b1dfc4f5131fd81274551",
            "f8d8f7800e7b67ab562c7d06a25a9bdefb5e7dab7bdcdceab06b1823e0bf028c",
            "d7eee68a144805c5c5b1ae59f0956b41cfcf9de9abc7f1ada90de5c702896a95"
        ],
        "globals": [
            "TURBOPACK",
            "__next_f",
            "next",
            "__webpack_hash__"
        ],
        "tls": {
            "san": [
                "www.graystonecoinhub.live"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR1",
            "subject": "www.graystonecoinhub.live",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-19T12:23:41Z",
            "valid_from": "2026-10-21T12:23:42Z"
        },
        "domain_age_days": 3,
        "apex_age_days": 3,
        "tls_age_days": 3,
        "tls_valid_days": 89,
        "requests": 15,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 96,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "Vercel",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=63072000"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-25T09:41:27Z",
        "uuid": "972a6f1c-6fcf-43c1-8bcc-d2bb678651a1",
        "scanned_at": "2026-10-25T09:38:27Z",
        "final_url": "https://www.graystonecoinhub.live/",
        "status": 200,
        "redirected": "subdomain",
        "history": [
            {
                "url": "https://graystonecoinhub.live/",
                "status": 308
            },
            {
                "url": "https://www.graystonecoinhub.live/",
                "status": 200
            }
        ],
        "dom_hash": "4b405751f8b8b13fba5cfb646f8ceb3eaeb95b84436daefee3fe62827a613d46",
        "doc_hash": "ef225f3fe03fa6eedce10698cb424f79c7edf2063cb4d2407ee3e1400e19aca8",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "graystonecoinhub.live",
                "type": "A",
                "value": "216.198.79.1"
            },
            {
                "name": "www.graystonecoinhub.live",
                "type": "CNAME",
                "value": "cname.vercel-dns.com"
            },
            {
                "name": "www.graystonecoinhub.live",
                "type": "CNAME",
                "value": "cname.vercel-dns.com"
            }
        ],
        "dnssec_valid": false,
        "ip": "66.33.60.130"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-25T09:37:24Z",
        "analysis_at": "2026-10-25T09:21:12Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "first_seen": "2026-10-21T14:47:35Z",
        "dns": [
            {
                "ttl": 7200,
                "type": "NS",
                "value": "ns4.my-ndns.com"
            },
            {
                "ttl": 7200,
                "type": "NS",
                "value": "ns3.my-ndns.com"
            },
            {
                "ttl": 7200,
                "type": "SOA",
                "rname": "root.graystonecoinhub.live",
                "value": "graystonecoinhub.live"
            },
            {
                "ttl": 7200,
                "type": "A",
                "value": "216.198.79.1"
            }
        ],
        "dns_at": "2026-10-25T09:26:30Z",
        "jarm": "3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fb",
        "cert": {
            "san": [
                "graystonecoinhub.live"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "5969a7bb7a2e8b389d9e76b97c2533cd0a2",
            "sha256": "54a535443dcc36d91d253a59a648d66730b61535b2168e17f8cbf32d8c3ff6fa",
            "subject": "graystonecoinhub.live",
            "valid_to": "2027-01-19T12:23:43Z",
            "valid_from": "2026-10-21T12:23:44Z"
        },
        "rdap": {
            "status": [
                "client delete prohibited",
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-10-20T16:00:00Z",
                "registration": "2026-10-20T16:00:00Z",
                "registrar expiration": "2027-10-20T16:00:00Z",
                "last update of RDAP database": "2026-10-20T16:00:00Z"
            },
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "registrar_iana_id": "3765"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-25T09:39:19Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "graystonecoinhub.live"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-25T09:00:33Z",
            "first": "2026-10-25T09:00:33Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 6946
        },
        "social_tags": {
            "title": "Graystone |  Trading Platform",
            "description": "Graystone is a trading and portfolio platform."
        },
        "trackers": {
            "requests": 11
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 308,
            "timings": {
                "dns": 2,
                "tls": 16,
                "wait": 15,
                "connect": 5,
                "download": 1
            },
            "response_ms": 39
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 31868,
            "co2_grams": 0.0012,
            "cleaner_than": 47
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "43.162.114.218",
                    "host": "ns4.my-ndns.com"
                },
                {
                    "ip": "154.85.54.43",
                    "host": "ns3.my-ndns.com"
                }
            ],
            "zone": "graystonecoinhub.live"
        },
        "location": {
            "ip": "216.198.79.1",
            "asn": "16509",
            "org": "Amazon.com, Inc.",
            "country": "US"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR2",
            "subject": "graystonecoinhub.live"
        },
        "dns": {
            "A": [
                "216.198.79.1"
            ],
            "NS": [
                "ns3.my-ndns.com",
                "ns4.my-ndns.com"
            ],
            "SOA": "{\"nsname\": \"graystonecoinhub.live\", \"hostmaster\": \"root.graystonecoinhub.live\", \"serial\": 2026102100, \"refresh\": 7200, \"retry\": 1800, \"expire\": 1209600, \"minttl\": 7200}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=63072000",
            "message": "HSTS header does not include all subdomains."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=63072000",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "216.198.79.1",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://graystonecoinhub.live",
                "https://www.graystonecoinhub.live/"
            ],
            "count": 1
        },
        "linked_pages": {
            "internal_count": 6
        },
        "headers": {
            "headers": {
                "server": "Vercel",
                "content-type": "text/html; charset=utf-8",
                "strict-transport-security": "max-age=63072000"
            }
        }
    }
}
```