grwwindia[.]com

On 23 July 2026, the domain grwwindia.com was assessed as an elevated‑risk generic phishing site. The domain was created on 21 February 2026 and is presently taken offline. Infrastructure analysis shows the domain is hosted behind Cloudflare (nameservers elma.ns.cloudflare.com and rocco.ns.cloudflare.com) and resolves to IP 172.67.129.147, which belongs to AS13335 Cloudflare, Inc. in the United States. The SSL certificate is issued by Google Trust Services under the WE1 certificate authority, indicating the HTTPS connection was properly provisioned. A scan on VirusTotal recorded 2 detections out of 93 security‑engine vendors, confirming malicious content.

The site is listed on one public blocklist and is actively blocked by PhishDestroy, further corroborating its malicious nature. The page title returned by the site is “Groww App India: Complete Investment Platform Guide,” suggesting an attempt to impersonate an investment platform, which aligns with the recorded scam type of a crypto scam. The underlying web stack comprises WordPress, MySQL, PHP, Yoast SEO, jQuery, jQuery Migrate, and Cloudflare Browser Insights, all typical of many legitimate sites, but the presence of a 0/100 Gridinsoft trust score indicates a high likelihood of abuse. Registration was performed through NiceNIC International Group Co., Limited, a registrar that does not inherently imply malicious intent but is noted for bulk registrations.

Evidence gaps remain: the actual payload, credential‑phishing pages, and any redirection behavior have not been captured because the site is offline, preventing direct HTTP status or content verification. Consequently, defenders cannot verify the exact login‑capture mechanism or the presence of additional malicious scripts. Given the observed indicators—recent domain creation, Cloudflare‑based hosting, low trust score, active blocklist entries, and VirusTotal detections—security operators should add grwwindia.