gro11z[.]com

PhishDestroy identifies gro11z.com as an active credential theft domain that presently remains undetected across multiple security vendors. Intelligence suggests the domain is being leveraged for a generic phishing campaign designed to harvest user credentials under the guise of a gift card or promotional offer lure. No specific drainer kit signature has been associated with the domain thus far, indicating either a newly deployed or rapidly evolving campaign that has evaded most detection engines.
gro11z.com resolves to IP 192.142.10.5 and was registered on April 07, 2026, through NameSilo, LLC. Despite employing a Let’s Encrypt SSL certificate, the domain currently registers a clean 5/95 detections on VirusTotal, has not been flagged by Google Safe Browsing, and shows no presence on known blocklists. The domain’s recent creation date and pristine detection score point to an early-stage operation that could escalate quickly as traffic volumes increase or payloads are updated.
The threat is currently categorized as active with a risk level under investigation. Immediate defensive actions include domain blocking at DNS and firewall levels, user awareness campaigns highlighting the fraudulent nature of gift card phishing lures, and continuous monitoring for changes in infrastructure or payload delivery mechanisms. While the immediate risk remains assessed as low due to the absence of detections, the potential for rapid escalation necessitates vigilant tracking and containment to prevent credential theft or downstream compromise. Network defenders are advised to implement web filtering rules and alert on any outbound connections to the observed IP.