install[.]grandmoney[.]top

The domain install.grandmoney.top was registered on 2026-08-01 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently hosted on Cloudflare infrastructure, resolving to 172.67.188.232. Its authoritative nameservers are cory.ns.cloudflare.com and kim.ns.cloudflare.com, indicating use of Cloudflare DNS. Within 24 hours of creation the domain appeared on a public security blocklist and was subsequently added to the PhishDestroy deny list, confirming that threat‑intel communities have observed malicious activity. VirusTotal scans show that 2 of 91 security vendors flagged the domain as malicious, providing independent confirmation of its hostile nature.

The limited vendor detection suggests that the payload or landing page may be evasive, but the blocklist presence and early registration pattern are consistent with a newly deployed phishing infrastructure. No public analysis of the site’s page title, SSL certificate details, or HTTP response has been released, so the exact content and target brand remain unknown. The high risk rating assigned by the reporting platform reflects the combination of early blocklist inclusion, vendor detections, and the use of a reputable CDN to mask the true hosting location. Because Cloudflare services can be shared among benign and malicious sites, relying solely on IP reputation may generate false positives; however, the specific domain name should be treated as malicious.

Defenders should immediately block DNS resolution to install.grandmoney.top, add the IP address 172.67.188.232 to network‑level deny lists, and monitor for any outbound traffic to Cloudflare edge nodes that could be used for command‑and‑control. Organizations should update email security gateways to inspect URLs pointing to install.grandmoney.top and enforce multi‑factor authentication to mitigate credential compromise.