gro32k[.]icu

Analysis of the domain gro32k.icu shows that it was registered on 21 February 2026 through NiceNIC International Group Co., Limited and uses Cloudflare’s DNS service (ezra.ns.cloudflare.com, melinda.ns.cloudflare.com). The domain resolves to the Cloudflare‑owned address 188.114.97.3, which is announced by AS13335 and geolocated to the United States. No TLS certificate is presented; attempts to establish an HTTPS connection receive no certificate, indicating the site either serves only HTTP or is currently offline. The public page title retrieved before takedown reads “GRO32K Official Pre‑Sale — Get Up to 200% Bonus!”, suggesting a fraudulent pre‑sale or investment lure.

VirusTotal has recorded 15 of 93 scanning engines flagging the domain as malicious, and the domain is listed on a security blocklist and has been actively blocked by the PhishDestroy service. The current operational status is offline, which may be the result of takedown actions or the operator’s own shutdown. Evidence for the specific phishing campaign is limited to the page title and the presence on blocklists; no additional payload, credential‑stealing forms, or malicious download vectors have been observed. Defenders should continue to monitor the domain’s resolution and DNS records, enforce blocklist rules that include gro32k.icu, and consider adding the IP address 188.114.97.3 to network‑level deny lists, especially for traffic originating from Cloudflare‑edge nodes that are not associated with legitimate services.

Because the site lacks a valid SSL certificate, any attempt to communicate over HTTPS will fail, providing an additional mitigation point. Organizations should also audit outbound connections to unknown pre‑sale or bonus offers and educate users that unsolicited investment invitations with exaggerated returns are typical of phishing campaigns.