gretrcap[.]com

This domain, gretrcap.com, was registered on May 12, 2026 through Dynadot Inc. It resolves to the Cloudflare‑owned address 188.114.97.3 located in Canada and is served by the nameservers amalia.ns.cloudflare.com and ned.ns.cloudflare.com. The site returns HTTP 200 and presents the page title “Gretrcap”. Its TLS certificate is issued by Google Trust Services under the WE1 intermediate, indicating a legitimate certificate chain but offering no protection against the malicious content hosted. Analysis of public threat feeds shows the domain is classified as a credential harvesting site. VirusTotal records a single positive detection out of 95 scanned security vendors, and AlienVault OTX lists the domain in one pulse. The domain appears on one external blocklist and is actively blocked by PhishDestroy. Gridinsoft assigns a trust score of 22 out of 100, reinforcing the low confidence in the site's legitimacy. Despite these indicators, the limited number of detections leaves several aspects uncertain. The exact phishing kit or credential collection mechanism has not been disclosed, and the low detection rate suggests that many security products have not yet flagged the content. The presence of a valid Google‑issued certificate may evade naive URL‑based filters, and the use of Cloudflare’s CDN can obscure the true origin of any malicious payload. Defenders should add gretrcap.com to inbound and outbound deny lists at the network perimeter and enforce DNS sinkholing for the domain. Continuous monitoring of TLS certificate changes and DNS resolution patterns is advised, as attackers may switch infrastructure while retaining the same domain. Incident response teams should also inspect any authentication attempts that reference gretrcap.com and consider user education about unsolicited credential requests that mimic legitimate services.