Is Grend a scam? TrustSniffer's high-risk assessment of grend.club: 0/100

Security Alert

Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The domain grend.club is a recently registered website on the ".club" top-level domain. When it was visited, the front page returned an access-denied response from the protective edge layer, and the page that loaded was a browser interstitial titled as a suspected-phishing warning. Only a very short fragment of text was captured. The site's products, services, branding and stated purpose therefore could not be read from its own content, and its business model cannot be established from first-hand page evidence.

Scam/Impersonation Risk

Confirmed contradictions are present, and this is the decisive element of the assessment. The domain is blacklisted. Multiple independent threat-intelligence sources currently flag it as malicious, including two tier-one security vendors, and a kill-switch condition was triggered by the volume of malicious detections. The page served to the analysis session was itself a suspected-phishing interstitial, which corroborates the external listings. The identity of the operator could not be independently connected to any real-world brand or person, so nothing on record offsets these findings. No conflicting legal entities were observed, and no specific brand impersonation was identified, because the page content was not retrievable. The risk therefore rests on the reputation and phishing-warning evidence rather than on analysed page claims. Behavioural testing showed heavy third-party traffic from the front page. Roughly nine in ten network interactions in the sandbox were external, with over a hundred background requests and several outbound submissions, all to recognised destinations. Dozens of console errors and a sharp page-structure change after interaction were also recorded. No wallet-connection prompts, clipboard manipulation, hidden forms or credential posts to external hosts were detected. These behavioural findings are secondary and do not mitigate the blacklisting. Evidence:

• Front page: the edge layer returned an access-denied response, and the captured page title was a suspected-phishing warning.
• Threat-intelligence coverage: 14 malicious and 1 suspicious detections out of 92 engines, including two tier-one vendors, with a blacklist flag confirmed.
• Domain registration: created 2026-06-16, about 0.38 years (~137 days) old, with expiry set to 2027-06-16.
• Front-page sandbox behaviour: 102 external background requests, 9 external POST submissions, 34 console errors, and a page-structure change of 1,523 mutations after interaction, with no wallet, clipboard or hidden-form activity.

Regulatory Verification Notes

No legal, terms, privacy or about pages could be reached, because capture was blocked at the front page. The site's licensing status, corporate registration and operator disclosures therefore cannot be assessed, and no third-party broker or regulator record matched the domain. The absence of a regulatory footprint does not by itself indicate fraud, but the site has no independently verifiable identity to set against the reputation findings above. The domain was registered through a commercial registrar, and the registrant details are shielded by privacy redaction. This is an administrative feature of the record, not a contradiction. The transport-layer posture is sound but does not indicate legitimacy. A valid, domain-validated certificate is in place, which proves only that someone controls the domain. Evidence:

• Registration: registered through PDR Ltd. d/b/a PublicDomainRegistry.com, with registrant details redacted for privacy.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 (DV), valid to 2027-01-11.
• Broker databases: no matching broker or regulator entry.

What to Verify Next

Verification here concerns whether the listings are current and whether any legitimate operator exists, not whether to proceed. Anyone with a business reason to interact should first re-check the domain's current status with the relevant threat-intelligence providers, since a listing can reflect either an operator-run abuse campaign or a compromise that has since been cleaned. Any claim to represent a company should be tested through a contact route obtained independently of this site, such as an official registry entry or a known corporate channel. The official support and contact channels should likewise be confirmed offline. The page title and block response should be reproduced from a different network and device profile, to establish whether the phishing interstitial is shown consistently. Evidence:

• Front page: the same block response and warning interstitial were returned on all three behavioural runs, so the behaviour appears consistent.
• Reputation: the malicious detections are current at the time of analysis and span more than one source.
• Identity: no operator, company name or registration number could be associated with the domain.

Summary Verdict

The site sits in the lowest trust tier, with a clearly cautionary posture. Confirmed external blacklisting and a phishing warning at the site's entry point outweigh every neutral or technical positive signal. The operator's real-world identity remains unestablished. Interaction involving credentials, logins or financial activity is classed as unsafe, and only passive, read-only exposure is considered acceptable.

Infrastructure Integrity

The site is fronted by Cloudflare's CDN and WAF, and all six observed addresses are edge servers. Their ownership is split between Cloudflare and a second large cloud provider. The origin server was not observable, which prevents independent verification of the true hosting and can mask rapid content swaps behind a stable front. Cloudflare's bot protection is active and the certificate is valid. These are mitigating factors only. They reflect shared infrastructure that many sites, legitimate or not, can use, and they cannot offset the reputation findings.

Closing Assessment

Credentials, payment details and personal data should not be entered on this site, and no files should be downloaded from it. Any contact initiated from it should be treated as unsolicited until proven otherwise. If it has already been visited and anything was submitted, the affected passwords should be changed and the relevant accounts monitored. Organisations should consider blocking the domain at the network or email-filtering layer while the listings remain active.