gricop[.]com

Analysis of the domain gricop.com shows a clear pattern of brand impersonation targeting Ethereum users. The domain was registered on February 21, 2026 and subsequently hosted on the Cloudflare network (AS13335) with the IP address 104.21.85.100, an address located in the United States. The site presented a page title of "Buy/Sell Bitcoin, Ether and Altcoins | Cryptocurrency Exchange | Gricop," which aligns with the declared scam type of a crypto scam and reinforces the attempt to lure victims with a legitimate‑sounding exchange service. Security telemetry indicates that the domain was flagged by one out of ninety‑three VirusTotal scanners, and it appears on a single external blocklist.

The site was also listed by the PhishDestroy blocklist, confirming that reputable threat‑intelligence feeds have identified it as malicious. A Gridinsoft trust score of 4 out of 100 further reflects a very low confidence in the domain’s safety. The SSL certificate is identified as "WE1," a generic certificate that does not provide any additional validation of the operator’s identity. Current monitoring shows the domain has been taken offline, which may be a temporary takedown or a deliberate removal after detection.

While the available evidence strongly supports that gricop.com was used for a cryptocurrency‑related scam impersonating Ethereum, the exact content served at the time of operation cannot be confirmed because the site is no longer reachable. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists with the observed IP address and ASN, and monitor for any re‑registration or similar domains that reuse the same hosting provider or certificate pattern. Further investigation of historical HTTP responses, if archived, would help clarify the specific lures and payloads employed, but the present indicators already justify a high‑confidence classification as a malicious crypto‑scam infrastructure.