grimecoin[.]io

On 17 September 2025 the domain grimecoin.io was registered through NiceNIC International Group Co., Limited. The domain resolves to the IPv6 address 2606:4700:3035::6815:3e99, which is owned by Cloudflare, Inc. (AS13335) and is located in the United States. DNS resolution uses the Cloudflare authoritative nameservers dorthy.ns.cloudflare.com and greg.ns.cloudflare.com, indicating that the infrastructure is fully delegated to Cloudflare’s network. HTTP requests to the site return a 301 redirect, and the TLS certificate presented is issued by Google Trust Services under the WE1 root, confirming that the site uses a valid, publicly trusted certificate.

The page title returned by the server reads “Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | GrimeCoin”, and the site is classified as a crypto‑scam that impersonates the Ethereum brand. VirusTotal analysis shows that six of ninety‑five scanning engines flagged the domain, and the site appears on one external blocklist. PhishDestroy has already added grimecoin.io to its blocklist, and AlienVault OTX reports a single threat‑intel pulse referencing the domain. A Gridinsoft trust score of 1 out of 100 further indicates a high likelihood of malicious intent.

Although the site’s exact content has not been examined, the combination of brand impersonation, a cryptocurrency‑focused title, and the presence on multiple security feeds suggests a coordinated effort to lure victims into a fraudulent exchange platform. Defenders should update URL filtering rules to block grimecoin.io, monitor outbound connections to the associated Cloudflare IP range for suspicious activity, and consider adding the domain to internal threat intelligence feeds. Continuous re‑scanning is advised, as the site remains active and could evolve its tactics.