grunix[.]help

Analysis indicates that grunix.help was registered on February 21 2026 through NameCheap, Inc. The authoritative nameservers are dns1.registrar-servers.com and dns2.registrar-servers.com. DNS resolution points to 104.21.44.35, an address owned by Cloudflare, Inc. (AS13335) and geolocated in the United States. The site serves an HTTP 302 redirect and presents no TLS certificate, leaving the connection unencrypted. Infrastructure scoring from Gridinsoft rates the domain at 0 out of 100, and the domain appears on a single known security blocklist.

VirusTotal scans show that 16 of 93 antivirus and URL‑reputation engines have flagged the domain as malicious. The phishing kit identified is the Gambler Scam kit, and the scam type is recorded as a crypto scam. The page title returned by the server reads “Grunix: Most Popular Online Crypto Casino Based on Blockchain,” which aligns with the advertised cryptocurrency casino theme. The domain is also listed as blocked by PhishDestroy.

While the available data confirms malicious intent, the exact content served after the redirect has not been captured, leaving the full payload and any credential‑phishing forms unverified. Defenders should add the IP address 104.21.44.35 and the domain grunix.help to URL filtering and DNS sinkhole rules, monitor for any future changes in SSL deployment, and track any additional detections from threat‑intel feeds. Continuous re‑scanning with multi‑engine services is advised to capture potential evolution of the phishing kit or new hosting arrangements. Given the high risk rating, immediate blocking is recommended to prevent exposure to the crypto‑casino phishing campaign.