# PhishDestroy domain threat record: grinduniversity.academy Content language: English Canonical HTML report: https://phishdestroy.io/domain/grinduniversity.academy/ Machine-readable companion: https://phishdestroy.io/domain/grinduniversity.academy/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: unknown - First observed by PhishDestroy: 2026-10-28 00:46:02 UTC - Stored record updated: 2026-10-28 01:13:09 UTC - VirusTotal detections in the stored snapshot: 16/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 2.59.170.20 - Registrar in stored WHOIS data: NameCheap, Inc. - Registration date in stored WHOIS data: 2025-09-28 14:03:47 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a027b5-96d6-756c-a6c1-96afda1d8390/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/grinduniversity.academy - Certificate Transparency search: https://crt.sh/?q=%25.grinduniversity.academy - Web Archive lookup: https://web.archive.org/web/*/https://grinduniversity.academy/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy added grinduniversity.academy to its internal blocklist on 2026-10-28. The intake flagged the domain because VirusTotal reported 14 malicious and 2 suspicious detections from 92 engines. A page fetch on the same day returned HTTP 503, indicating no content was served at that moment. How the scam works The multiple phishing‑related detections suggest the site could be used to harvest credentials or lure users, but no specific malicious page content was captured. Without observed forms, redirects, or wallet requests, the exact scheme cannot be confirmed. Evidence VirusTotal scanned the domain on 2026-10-26 (retrieved 2026-10-28) and marked it malicious by 14 vendors and suspicious by 2. Google Safe Browsing checked on 2026-10-28 and did not flag the domain. urlscan.io captured a screenshot on 2026-08-22 (retrieved 2026-10-28); the request returned HTTP 503 and its ML engine gave a malicious score of 36, while the overall verdict was clean. OTX listed one pulse referencing the domain as of 2026-10-28, and no external blocklists reported it as malicious on that date. Infrastructure The domain was registered on 2025-09-28 through NameCheap, Inc. with a client‑transfer‑prohibited status. DNS records observed on 2026-10-28 show two A records (2.59.170.20 and 104.219.250.37) and the domain uses a Let's Encrypt certificate valid until 2026-11-21. The urlscan capture recorded the IP 172.67.145.51, which belongs to Cloudflare’s network, and the IP 104.219.250.37 resolves to an ASN owned by Namecheap in the United States. What to do Do not submit any credentials, private keys or personal information to this site; if you have already done so, change the associated passwords and enable multi‑factor authentication. Network defenders should block grinduniversity.academy at firewalls or proxies and monitor outbound traffic for connections to its resolved IP addresses. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a027b5-96d6-756c-a6c1-96afda1d8390/ Cloudflare Radar report: https://radar.cloudflare.com/scan/3c7cf633-a2b3-4450-a32a-2a9fcfc6a6f9 Stored capture screenshot: https://urlscan.io/screenshots/01a027b5-96d6-756c-a6c1-96afda1d8390.png Cloudflare Radar screenshot (2026-10-28T00:54:55Z): https://screenshots.phishdestroy.io/cf/3c7cf633-a2b3-4450-a32a-2a9fcfc6a6f9.png VirusTotal report: https://www.virustotal.com/gui/domain/grinduniversity.academy Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=grinduniversity.academy Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-28 00:57:00 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a027b5-96d6-756c-a6c1-96afda1d8390.png Captured: 2026-10-28 00:46:02 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a027b5-96d6-756c-a6c1-96afda1d8390.png Source report: https://urlscan.io/result/01a027b5-96d6-756c-a6c1-96afda1d8390/ - URLScan · 2026-04-20: https://screenshots.phishdestroy.io/us/019dace8-a151-77a6-b39a-450a1c42ca4e.png Captured: 2026-04-20 22:00:26 UTC Source report: https://urlscan.io/result/019dace8-a151-77a6-b39a-450a1c42ca4e/ SHA-256: 4a4697f6bf8e04eb88f48727552946ca2b9bcdefa0f2c9f52a4823fcfc85fe32 - URLScan · 2026-04-21: https://screenshots.phishdestroy.io/us/019daee1-b8d9-7178-a990-81f473d74b7b.png Captured: 2026-04-21 07:12:08 UTC Source report: https://urlscan.io/result/019daee1-b8d9-7178-a990-81f473d74b7b/ SHA-256: 4a4697f6bf8e04eb88f48727552946ca2b9bcdefa0f2c9f52a4823fcfc85fe32 - URLScan · 2026-07-13: https://screenshots.phishdestroy.io/us/019f5b9e-4000-701f-a21e-af1c5f6a7504.png Captured: 2026-07-13 13:15:31 UTC Source report: https://urlscan.io/result/019f5b9e-4000-701f-a21e-af1c5f6a7504/ SHA-256: 589291a7e8ee9ff9830ea4be818fa8290d422509ede8798fab551b65207bea17 - URLScan · 2026-08-08: https://screenshots.phishdestroy.io/us/019fe0b4-c91d-70ac-b98b-8f8f7cc0068d.png Captured: 2026-08-08 09:29:38 UTC Source report: https://urlscan.io/result/019fe0b4-c91d-70ac-b98b-8f8f7cc0068d/ SHA-256: 9d6033fea6cf942e6efa5f6bba7d3bdf0b912e081993190a40db9c6701213140 - URLScan · 2026-08-12: https://screenshots.phishdestroy.io/us/019ff73b-b36c-74e0-81a7-a0377fc7e67d.png Captured: 2026-08-12 18:28:39 UTC Source report: https://urlscan.io/result/019ff73b-b36c-74e0-81a7-a0377fc7e67d/ SHA-256: 9d6033fea6cf942e6efa5f6bba7d3bdf0b912e081993190a40db9c6701213140 - URLScan · 2026-10-28: https://screenshots.phishdestroy.io/us/01a17ffb-5169-75b9-8993-34825c83c0e3.png Captured: 2026-10-28 00:49:16 UTC Source report: https://urlscan.io/result/01a17ffb-5169-75b9-8993-34825c83c0e3/ SHA-256: a7bae4aff363a4e6c770439e2832b96bddca88e7574c96708846fb6da6f6b738 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/3c7cf633-a2b3-4450-a32a-2a9fcfc6a6f9.png Captured: 2026-10-28 00:54:55 UTC Source report: https://radar.cloudflare.com/scan/3c7cf633-a2b3-4450-a32a-2a9fcfc6a6f9 SHA-256: a5db7ab655d3900bfb2bf44f8483ca7ce06fc6f795376f14b777be50f1f0af62 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-28T00:55:35Z", "uuid": "01a027b5-96d6-756c-a6c1-96afda1d8390", "scanned_at": "2026-08-22T04:23:33Z", "final_url": "https://grinduniversity.academy/", "status": 503, "ip": "172.67.145.51", "ips": [ "172.67.145.51" ], "asns": [ "13335" ], "doc_hash": "6447a2882c4f20346b7b0f041d50d090d7c9aed4620dae267b56456686b11b3d", "tls": { "san": [ "*.grinduniversity.academy", "grinduniversity.academy" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "grinduniversity.academy", "protocol": "QUIC", "valid_to": "2026-09-23T16:40:05Z", "valid_from": "2026-06-25T16:40:06Z" }, "domain_age_days": 327, "apex_age_days": 327, "tls_age_days": 57, "tls_valid_days": 89, "requests": 2, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 36, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-28T00:55:38Z", "uuid": "3c7cf633-a2b3-4450-a32a-2a9fcfc6a6f9", "scanned_at": "2026-10-28T00:54:55Z", "final_url": "https://grinduniversity.academy/", "history": [ { "url": "https://grinduniversity.academy/", "status": 0 } ], "dom_hash": "0be15d34945b061b4688e4c7a258d982bf21eeec94f047738c21f26a19145958", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "grinduniversity.academy", "type": "A", "value": "2.59.170.20" }, { "name": "grinduniversity.academy", "type": "A", "value": "104.219.250.37" } ], "dnssec_valid": false }, "vt": { "v": 1, "fetched_at": "2026-10-28T00:53:56Z", "analysis_at": "2026-10-26T01:40:51Z", "stats": { "timeout": 0, "harmless": 43, "malicious": 14, "suspicious": 2, "undetected": 33 }, "detections": { "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "SOCRadar": "phishing", "Kaspersky": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "created": "2025-09-28T00:00:00Z", "updated": "2025-09-28T00:00:00Z", "first_seen": "2025-09-28T16:57:33Z", "dns": [ { "ttl": 3600, "type": "NS", "value": "ns1.lander.d.parity.domains" }, { "ttl": 3600, "type": "SOA", "rname": "hostmaster.lander.d.parity.domains", "value": "ns1.lander.d.parity.domains" }, { "ttl": 60, "type": "A", "value": "104.219.250.37" }, { "ttl": 60, "type": "A", "value": "2.59.170.20" }, { "ttl": 3600, "type": "NS", "value": "ns2.lander.d.parity.domains" } ], "dns_at": "2026-10-26T01:41:38Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.grinduniversity.academy", "grinduniversity.academy" ], "issuer": "Let's Encrypt / YE2", "serial": "5e9c2f808cf061ee6fdc49ba72782b298fe", "sha256": "f9c01d7788d11279b9ac8b6415b8ea79765771a736660be684018aff85221fae", "subject": "grinduniversity.academy", "valid_to": "2026-11-21T18:25:51Z", "valid_from": "2026-08-23T18:25:52Z" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "registration": "2025-09-28T16:03:47Z", "registrar expiration": "2026-09-28T16:03:47Z", "last update of RDAP database": "2026-10-24T22:36:48Z" }, "registrar": "NAMECHEAP INC", "registrar_iana_id": "1068" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-28T00:55:58Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "grinduniversity.academy" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "ports": { "open": [ 80, 443 ] }, "dns_server": { "ns": [ { "ip": "192.236.150.131", "host": "ns1.lander.d.parity.domains" }, { "ip": "162.222.205.190", "host": "ns2.lander.d.parity.domains" } ], "zone": "grinduniversity.academy" }, "location": { "ip": "104.219.250.37", "asn": "22612", "org": "Namecheap, Inc.", "city": "Phoenix", "country": "US" }, "dns": { "A": [ "2.59.170.20", "104.219.250.37" ], "NS": [ "ns1.lander.d.parity.domains", "ns2.lander.d.parity.domains" ], "SOA": "{\"nsname\": \"ns1.lander.d.parity.domains\", \"hostmaster\": \"hostmaster.lander.d.parity.domains\", \"serial\": 8, \"refresh\": 7200, \"retry\": 3600, \"expire\": 1209600, \"minttl\": 60}" }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "get_ip": { "ip": "104.219.250.37", "family": 4 } } } ```