gro72f[.]icu

Analysis as of July 23 2026 indicates that the domain gro72f.icu was registered on February 21 2026 through NiceNIC International Group Co., Limited. The domain resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc., located in the United States. The authoritative nameservers are brady.ns.cloudflare.com and leah.ns.cloudflare.com, confirming the use of Cloudflare's DNS infrastructure. No TLS certificate is presented; the site served without HTTPS.

The HTTP response is currently offline, suggesting the site has been taken down, but historical evidence shows the page title “GRO72F Official Pre‑Sale — Get Up to 200% Bonus!” which aligns with a typical pre‑sale or bonus lure used in phishing campaigns. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service. VirusTotal scans have recorded 15 detections out of 95 scanners, indicating that a notable fraction of commercial engines classify the host as malicious. The combination of recent creation, fast‑flux‑like use of Cloudflare, lack of encryption, and the presence of a bonus‑centric page title points to a generic phishing operation aimed at enticing victims with inflated returns.

Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms, as no sample page content or malware indicators have been released. Defenders should continue to block the domain at perimeter firewalls, DNS filtering, and proxy solutions, and monitor for any outbound connections to the associated Cloudflare IP. Incident response teams should also consider adding the domain to internal blocklists and reviewing recent logs for any access attempts before the takedown. Ongoing observation of the IP reputation and any re‑hosting activity is advised, as attackers frequently shift infrastructure after takedowns.