governance-grovefinance[.]xyz

This domain, governance-grovefinance.xyz, is identified as a crypto drainer operation impersonating Grove Protocol, a platform associated with stablecoin infrastructure. Analysis indicates the site employs deceptive branding, including the page title 'Grove Protocol — Capitalizing the Stablecoin Economy,' to lure victims into connecting wallets, likely facilitating unauthorized token transfers. No specific drainer kit has been conclusively linked to this instance, though the tactics align with common crypto-focused phishing frameworks targeting decentralized finance users. Infrastructure analysis reveals the domain was registered on April 28, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with malicious registrations. It resolves to the IP address 172.67.158.20, a Cloudflare proxy endpoint that obscures the true hosting origin. Detection metrics show 5 out of 95 security vendors on VirusTotal flag the domain as malicious, while it appears on three independent security blocklists. Gridinsoft assigns a trust score of 0/100, further corroborating its high-risk classification. Google Safe Browsing does not currently list the domain, though this may reflect a lag in propagation rather than benign status. The domain has been taken offline, likely in response to escalating detection and blocklist inclusion. However, residual risk persists due to the potential for rapid re-deployment under new domains or IPs. Users who interacted with the site prior to its takedown should immediately revoke wallet permissions, audit connected applications, and monitor transaction histories for unauthorized activity. The use of Cloudflare proxy services and a registrar with a history of abuse underscores the need for heightened vigilance when engaging with unverified crypto-related platforms. Ongoing monitoring of related infrastructure is recommended to identify potential successor domains.