gro95z[.]com

PhishDestroy identifies gro95z.com as an active crypto drainer domain currently under investigation for generic phishing activities. This domain is suspected to impersonate MetaMask wallet interfaces to deceive users into connecting fraudulent wallets. The threat is classified as a high-risk drainer due to its active status and alignment with known tactics employed by threat actors targeting cryptocurrency users.

This domain was flagged by 5 of 95 VirusTotal vendors as of the latest scan, indicating a potential zero-day threat or evasion technique. gro95z.com was registered via NameSilo, LLC on March 24, 2026, and resolves to IP address 195.160.223.158. No blocklist entries or trust scores are currently available, suggesting this domain has not yet been widely categorized or blacklisted by security vendors. The Let’s Encrypt SSL certificate adds a veneer of legitimacy, further complicating detection efforts.

Users and organizations are advised to immediately block gro95z.com at the network and DNS levels to prevent access. Additionally, monitor for any connections to 195.160.223.158 and inspect endpoints for signs of unauthorized wallet connections or cryptocurrency transactions. Security teams should update firewall rules and intrusion detection systems to flag this domain and IP as malicious. Exercise caution when encountering MetaMask or similar wallet-related prompts, and verify URLs through official sources prior to any interaction.