fin103[.]grayku[.]com

The domain fin103.grayku.com was registered on May 21, 2019 through GoDaddy.com, LLC and is served by the standard GoDaddy nameservers ns11.domaincontrol.com and ns12.domaincontrol.com. DNS resolution points to the IPv4 address 148.72.73.195, which remains active as of the report date. The domain is classified as a generic_phishing site with a high risk rating. VirusTotal scans have returned detections from 18 of 91 security vendors, indicating a consensus that the host is being used for malicious activity. No public content analysis is currently available, so the exact phishing lures, credential‑stealing pages, or targeted brands cannot be confirmed. Infrastructure analysis shows no additional aliases or related subdomains disclosed in the available intelligence. Defenders should add fin103.grayku.com to block lists, enforce DNS sinkholing where possible, and monitor outbound traffic for connections to the associated IP address. Continuous re‑scanning of the domain with sandbox and URL analysis tools is recommended to capture any evolving payloads or campaign changes. Organizations that employ email filtering should flag messages containing this domain as malicious, and incident response teams should treat any compromised credentials originating from this host as potentially compromised.