gro89k[.]icu

Analysis on 23 July 2026 indicates that the domain gro89k.icu was created on 21 February 2026 via NiceNIC International Group Co., Limited and is currently hosted on Cloudflare’s network (AS13335). DNS resolution points to 188.114.96.3, a Cloudflare‑owned address located in the United States. The authoritative nameservers are austin.ns.cloudflare.com and martha.ns.cloudflare.com. The site presented the page title “GRO89K Official Pre‑Sale — Get Up to 200% Bonus!” suggesting a promotional lure, but the host no longer returns HTTP content; the domain is listed as taken offline.

No TLS certificate was observed, meaning any attempt to access the site would have been over plain HTTP. Threat intelligence feeds have flagged the domain: PhishDestroy has blocked it, and it appears on a single external blocklist. VirusTotal scans show that 16 of 95 scanning engines flagged the domain, reinforcing the malicious assessment. Because the infrastructure relies on a shared Cloudflare IP, direct takedown of the address may impact legitimate services, so defenders should focus on domain‑level mitigation.

Recommended actions include adding gro89k.icu to corporate web filters, updating DNS blocklists, and monitoring traffic to 188.114.96.3 for any residual activity. Continuous review of Cloudflare‑assigned IP ranges for similar newly registered domains is advisable. The lack of an SSL certificate and the offline status limit current observable behavior, so further probing is not possible until the site reappears. Analysts should treat the domain as a confirmed phishing vector and apply elevated‑risk controls consistent with the observed detection count.