gro79a[.]icu

The domain gro79a.icu has been flagged as a high-risk phishing threat impersonating a pre-sale initiative for a product purportedly named GROK28G, promising users a bonus up to 200%. According to available intelligence, this domain was registered on May 19, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain currently resolves to the IP address 188.114.97.3, which is associated with a broader network of suspicious domains. Security analysis indicates that gro79a.icu appears in 16 threat intelligence pulses, suggesting significant recognition among security platforms and increasing awareness of potential fraudulent activities linked to this domain.

Infrastructure examination reveals that this domain is actively utilizing modern web technologies, including particles.js and reCAPTCHA, alongside being served through Cloudflare, which may obscure its origin and host. The SSL certificate for this domain is issued by Google Trust Services, which can often mislead users into believing that the domain is trustworthy. The detection statistics from VirusTotal show that 8 out of 95 security vendors have flagged the domain, reinforcing the concern regarding its legitimacy. Additionally, gro79a.icu is listed on two security blocklists, highlighting the ongoing threat it poses to users.

Defensively, entities should prioritize blocking this domain along with the associated IPs, ensuring compliance with prevalent security policies. The low trust score of 0/100 from Gridinsoft indicates a high level of risk and reinforces the need for heightened vigilance. Organizations are advised to educate employees and users regarding the characteristics of phishing attempts, particularly those that involve attractive financial incentives, to mitigate potential exposure. Monitoring for any communications or alerts that reference this domain is critical, as it could indicate attempts to circumvent established security protocols by this entity.