growquanta[.]com

Analysis of growquanta.com indicates an active phishing infrastructure registered on May 20, 2026, through Name.com, Inc. The domain is currently resolving to the IP address 149.56.250.51 and is associated with nameservers ns5.ddoscure.com, ns6.ddoscure.com, protected3.ddoscure.com, and protected4.ddoscure.com. This configuration suggests the use of a bulletproof or reseller DNS provider commonly leveraged by threat actors to evade takedowns. As of July 27, 2026, the domain appears on one security blocklist and is flagged by PhishDestroy, a specialized anti-phishing service. VirusTotal data shows a single detection out of 91 security vendors, which may indicate early-stage detection or limited visibility into this specific campaign.

The domain's registration age—just over two months at the time of this report—aligns with typical phishing lifecycle patterns, where domains are often used shortly after creation to exploit minimal detection coverage. No specific brand impersonation, scam type, or phishing kit has been confirmed in the available data, and the exact content of the site remains unanalyzed. The hosting IP, 149.56.250.51, has been observed in prior malicious activity, though attribution to a specific hosting provider or autonomous system is not provided in the current intelligence. Defenders should treat growquanta.com as high-risk infrastructure.

Network-level blocking of the domain and its resolving IP is recommended, particularly for organizations with exposure to credential theft or financial fraud risks. Monitoring for related domains registered under the same nameservers or registrar may help identify additional threats. Given the domain's active status and detection by a dedicated anti-phishing service, further investigation into its targeting scope and payload delivery mechanisms is warranted.