gentrisfunds[.]com

Analysis of gentrisfunds.com, observed as a brand‑impersonation infrastructure targeting Apple, indicates that the domain was registered on 12 May 2025 through GMO Internet, Inc. The site resolves to the IPv4 address 102.209.117.141, which is announced by AS329184 Host Africa (Pty) Ltd and geolocated to South Africa. The web server reports Nginx powered by OpenResty, and the TLS certificate is issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority ‑ G2, confirming a commercial SSL provisioning. The page title returned by the HTTP response is “Home ‑ Gentrisfund”, and the site is currently offline, having been taken down and flagged by the PhishDestroy blocklist. The domain appears on a single external security blocklist, and a Gridinsoft trust score of 0 / 100 further reflects a high‑risk rating.

A VirusTotal scan involving 95 antivirus and URL analysis engines recorded no detections, which does not constitute a safety assurance. The infrastructure also uses the nameservers dan1.host-ww.net and dan2.host-ww.net, typical of a shared hosting environment. The combination of a recent registration date, low trust score, association with a known Apple‑impersonation campaign, and placement on a phishing blocklist suggests that gentrisfunds.com was employed in a tech‑support scam operation.

At present, the exact content of the landing page and any credential‑harvesting mechanisms remain unknown because the site is offline. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the host or related subdomains, and include the IP address 102.209.117.141 in threat‑intel feeds. Additional investigation of the hosting provider and nameserver owner may reveal further related malicious assets.