grayscaledesktop[.]app

PhishDestroy identifies grayscaledesktop.app as a high-risk generic phishing threat targeting cryptocurrency users. The site impersonates the legitimate Grayscale brand to steal login credentials or crypto assets, a tactic commonly seen in crypto drainer attacks. With an elevated risk level and current offline status, this domain posed a clear danger to anyone seeking multi-asset crypto management tools.

Security analysis reveals several red flags. VirusTotal detected the domain as malicious by 2 out of 95 security vendors, indicating early but significant recognition of its threat. The domain was registered through NiceNIC International Group Co., Limited, a registrar often associated with suspicious domains, and was created on February 21, 2026—a very recent registration for a site claiming to be an established service. It resolves to IP address 216.198.79.1 and appears on one security blocklist, while its SSL certificate (Let's Encrypt / R13) provides only basic encryption without verifying legitimacy.

Users should avoid visiting grayscaledesktop.app entirely. If credentials were entered, they must be changed immediately on the official Grayscale website and any other platforms using the same password. Enable two-factor authentication on all crypto accounts and monitor for unauthorized transactions. PhishDestroy recommends verifying any crypto management tool through official channels before use, and reporting suspicious domains to security blocklists to protect others.