PhishDestroy’s intake flagged the site as malicious because an admin report noted the domain was only three days old and an AI model assigned a high phishing confidence. The domain was first seen by PhishDestroy on 2026-10-25, four days after its registration on 2026-10-21, and the HTTP response at that time was a 308 redirect to the www subdomain followed by a 200 OK. The recorded page title reads “Graystone | Trading Platform” and the meta description describes it as a trading and portfolio platform.
How the scam works
Fake trading platforms lure visitors by promising easy, high‑return opportunities in Forex, cryptocurrency, commodities or indices, then request deposits or personal data to unlock the promised profits. No genuine exchange or brokerage infrastructure exists, so any funds or credentials provided are lost or abused.
Evidence
VirusTotal scanned the domain on 2026-10-25 with 92 engines and reported zero malicious or suspicious detections. Google Safe Browsing checked the same day and did not flag the site. OTX listed four pulses referencing the domain on 2026-10-25. URLScan’s machine‑learning engine marked the page malicious with a score of 96, although its overall verdict was non‑malicious. PhishDestroy’s internal blocklist contains graystonecoinhub.live, while external blocklists returned no matches.
Infrastructure
The domain was registered with NICENIC INTERNATIONAL GROUP CO., LIMITED on 2026-10-21. DNS records at the time pointed to an A record of 216.198.79.1 and a CNAME to Vercel’s DNS service; the page fetch also recorded the IP 66.33.60.130 belonging to Amazon ASN 16509. TLS was provided by Let’s Encrypt, issued on 2026-10-21 and valid until 2027-01-19, and the response included a strict‑transport‑security header with a two‑year max‑age.
What to do
Visitors should avoid entering credentials, financial information or deposits on the site; if they have already done so, they should change any used passwords and monitor accounts for unauthorized activity. Defenders should add graystonecoinhub.live to blocklists and threat‑intel feeds and review network logs for connections to this exact domain or the recorded IP addresses.
Stored registration data identifies NICENIC INTERNATIONAL GROUP CO., LIMITED (IANA 3765) as the registrar. PhishDestroy maintains separate NiceNIC abuse-report research; registrar association is contextual and is not an independent detection for this domain.
この gTLD では、上記のレジストラは ICANN の認定契約に基づいて運営されています。以下のリンクから、公式の料金表と現行の DNS 不正利用に関するコンプライアンスガイダンスを確認できます。
認定は契約であり、安全性の認証ではありません。
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Hostnames retained in the domain record or Certificate Transparency cache. A hostname alone does not establish current availability or malicious activity.
www.graystonecoinhub.liveDomain record
The original observation time is not recorded for these hostnames.
使用技術 · 2 identified
V
Vercel
PaaS
Vercel is a cloud platform for static frontends and serverless functions.
Source: availability monitor. This journal includes earlier observations and repeated states with distinct dates or evidence. Identical records appear once; an unknown state is not proof that the site is offline.
