groddy[.]run

The domain groddy.run has been identified as a credential theft operation masquerading as a legitimate custom development and automation service. Analysis indicates the site targets users seeking technical services, likely harvesting login credentials or sensitive project details under false pretenses. As of the latest assessment, the domain has been taken offline, though prior activity remains a documented threat. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk registrations. It resolved to the IP address 188.114.97.3, a Cloudflare-protected endpoint utilizing HTTP/3, a configuration commonly observed in phishing infrastructure to evade detection. The SSL certificate was issued by Google Trust Services, adding a superficial layer of legitimacy. Detection metrics show the domain was flagged by 2 of 95 security vendors on VirusTotal, while independent trust scoring systems assigned a 0/100 trust rating. The domain appears on one security blocklist, indicating limited but confirmed malicious classification. Current status confirms groddy.run is offline, though residual risk persists for users who may have interacted with the site prior to takedown. Organizations and individuals are advised to review access logs for connections to 188.114.97.3 or the domain itself, particularly if custom development services were solicited during the active period. Credential rotation is recommended for any accounts potentially exposed. Network-level blocking of the IP and domain is advised as a preventive measure. Given the registrar’s history, monitoring for re-registration under similar naming schemes is warranted.