web[.]greluna[.]com

PhishDestroy identifies web.greluna.com as a suspected cryptocurrency drainer site actively distributing SOCIAL_ENGINEERING threats. This domain mimics legitimate services to trick users into connecting crypto wallets, enabling unauthorized fund transfers. While no specific drainer kit was identified in the dataset, the presence of SOCIAL_ENGINEERING flags strongly suggests a wallet-draining operation targeting unsuspecting cryptocurrency holders.

This domain was flagged with a 6/95 VirusTotal detection score, indicating a low immediate signature-based risk but not ruling out sophisticated evasion techniques. The domain resolves to IP 104.21.87.190, is registered via Gname.com Pte. Ltd., and was created on August 30, 2018. Google Safe Browsing lists it under SOCIAL_ENGINEERING with no additional blocklist entries currently assigned.

As of the latest assessment, web.greluna.com remains active and unblocked by major browsers. Immediate action should be taken by users to avoid visiting the domain and to report it to relevant authorities such as Google Safe Browsing and local cybercrime units. Remaining risk is moderate due to the domain’s age and evasion tactics, warranting continued monitoring and proactive threat intelligence updates. Avoid connecting wallets or entering sensitive data on this domain.