gro79a[.]com

The domain gro79a.com is a generic phishing site that presents an elevated risk of financial fraud. It was observed promoting a fictitious cryptocurrency presale with promises of 'up to 200% bonus' under the false pretense of an 'official website.' No legitimate brand or drainer kit was identified, but the site operated as a broad credential and investment scam. As of the latest verification, gro79a.com has been taken offline.

Technical indicators confirm the malicious nature of gro79a.com. The domain was flagged by 3 of 95 security vendors on VirusTotal, including Forcepoint ThreatSeeker, Gridinsoft, and SOCRadar, while Gridinsoft assigned it a trust score of 0 out of 100. It appeared on one security blocklist (PhishDestroy) and was detected in a single AlienVault OTX threat intelligence pulse. Registered through Ultahost, Inc. on May 18, 2026, the domain resolved to the IP address 75.2.60.5, hosted on AWS Global Accelerator in the US. The SSL certificate was issued by Let's Encrypt (E7), and Cloudflare nameservers (mark.ns.cloudflare.com and nucum.ns.cloudflare.com) were in use. Google Safe Browsing did not flag the domain at the time of analysis.

Individuals who interacted with gro79a.com should assume their credentials or financial details may have been compromised. Change passwords immediately, enable multi-factor authentication on all accounts, and monitor for unauthorized transactions. If cryptocurrency was involved, revoke any token approvals and transfer remaining funds to a new wallet. Report the domain to local cybercrime authorities, the registrar (Ultahost, Inc.), and platforms like Google Safe Browsing or PhishTank to aid in takedown efforts.