grlvt[.]icu

Analysis of the domain grlvt.icu, created on 21 February 2026, shows a high‑risk wallet/seed phishing infrastructure. The domain is registered through PDR Ltd. d/b/a PublicDomainRegistry.com and is hosted on Cloudflare’s network (AS13335) with the IP address 172.67.164.1 located in the United States. No TLS certificate is presented, indicating that the site was served over plain HTTP when it was active. The page title returned by the live endpoint was “95,189 | BTC‑USD | Extended”, a pattern commonly associated with cryptocurrency price feeds, which aligns with the observed wallet/seed phishing classification. Threat intelligence sources corroborate the malicious intent.

AlienVault OTX lists the domain in one pulse, and VirusTotal recorded detections from 14 of 95 scanning engines, reinforcing the high‑risk assessment. The domain appears on four independent blocklists and is actively blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL. Gridinsoft assigns a trust score of 0 out of 100, indicating a complete lack of credibility. The nameservers chin.ns.cloudflare.com and tosana.ns.cloudflare.com resolve to the same Cloudflare edge, a common tactic for fast‑flux or disposable phishing sites.

Current status shows the domain taken offline, but the underlying infrastructure—registrar, hosting, and DNS configuration—remains functional and could be re‑activated. Defenders should continue to block the domain at network perimeter and DNS layers, monitor the associated IP address for any future activity, and add the domain to internal threat feeds. Because the site used a cryptocurrency‑related page title, organizations handling crypto wallets should be alerted to the specific wallet/seed phishing vector. Ongoing observation of the registrar PDR Ltd. and the Cloudflare IP range is recommended to detect potential re‑use of the same infrastructure for new phishing campaigns.