grentun[.]icu

Analysis of the domain grentun.icu indicates that it was registered on 21 February 2026 and is currently taken offline. The site hosted a page titled “Unlock Finance Success with AMLTestWallet & AMLCheck 2!” which aligns with the observed crypto‑scam classification. The TLS certificate associated with the domain carries the R12 rating, suggesting a low‑trust or self‑signed certificate. Network resolution points to the IPv4 address 91.92.242.155, which is announced by AS202412 owned by Omegatech LTD and geolocated to the Netherlands.

Reputation services have flagged the address; Gridinsoft assigned a trust score of 0 out of 100, confirming a malicious assessment. VirusTotal scans show that 13 of 93 anti‑malware engines flag the domain as malicious, providing independent corroboration of its threat profile. The domain appears on one public blocklist and has been actively blocked by the PhishDestroy service, indicating that at least one defensive tier already rejects traffic to it. No additional public blocklists, Safe Browsing entries, or Open Threat Exchange identifiers are recorded in the available intelligence.

Defenders should ensure that the IP 91.92.242.155 is denied at network perimeter and that any DNS resolvers are configured to return NXDOMAIN for grentun.icu. Adding the domain to internal blacklists and sharing the indicator with threat‑intel sharing platforms will reduce exposure. Continuous monitoring of the AS202412 prefix for newly created domains with similar creation dates or page titles is recommended, as adversaries frequently reuse the same hosting infrastructure for subsequent campaigns. Because the site is offline, any active exploitation attempts are likely halted, but the infrastructure may be repurposed; therefore, the recommendation to block the host and retain the indicator for future correlation remains critical.