gr[.]aichat-mybluecheck-cpl[.]cyou

Analysis of gr.aichat-mybluecheck-cpl.cyou indicates that the domain was registered on 21 February 2026 and is currently taken offline. The site presented the page title “Facebook – log in or Sign up”, matching the declared brand target of Facebook and confirming a social‑media phishing impersonation. VirusTotal recorded nine detections out of ninety‑three scanning engines, demonstrating that a minority of AV vendors have flagged the host as malicious. The SSL certificate is identified as “WE1”, and the Gridinsoft trust score is 0 / 100, reinforcing the low credibility of the service.

Network resolution points to the IPv4 address 188.114.97.3, which belongs to AS13335, Cloudflare, Inc., located in the United States. The IP address is listed on a single security blocklist and the domain is actively blocked by the PhishDestroy feed. The domain appears on one known blocklist, and no additional public blocklists or Safe Browsing entries were observed. No registrar information or evidence links were supplied.

Defenders should treat any traffic to this domain as hostile, enforce outbound filtering to block the IP 188.114.97.3, and add the domain to internal blocklists. Continuous monitoring of Cloudflare‑hosted IP ranges for similar impersonation activities is recommended, as the low trust score and multiple vendor detections suggest the presence of a phishing kit targeting Facebook credentials. Because the site is offline, immediate exploitation risk is reduced, but the infrastructure may be reused for future campaigns.