gro31q-cointelegraph[.]com

The domain gro31q-cointelegraph.com was registered on May 19, 2026 through Ultahost, Inc. It resolves to the Cloudflare‑owned address 188.114.97.3, which is geolocated to Canada. The authoritative name servers are mark.ns.cloudflare.com and nucum.ns.cloudflare.com, indicating that the domain is hosted behind Cloudflare’s CDN. HTTP requests return a 403 status and the only observed page title is “Just a moment…”, suggesting a Cloudflare challenge page rather than a legitimate site. The SSL certificate is issued by Let’s Encrypt (CN=E7), a free certificate typically used by both benign and malicious operators. Reputation services flag the domain as high‑risk: Gridinsoft assigns a trust score of 0/100, it appears on one security blocklist, and PhishDestroy has already blocked it. AlienVault OTX references the domain in a single threat‑intel pulse, and VirusTotal reports that one of ninety‑two scanners flagged it. No additional malicious payloads, redirects, or credential‑harvesting pages have been observed, and the content beyond the title remains unverified. Given the combination of a newly created domain, low trust score, blocklist presence, and a detection by a security vendor, defenders should treat gro31q-cointelegraph.com as a confirmed phishing indicator. Recommended actions include adding the domain to network and email filtering rules, monitoring DNS queries for the associated IP, and updating intrusion‑detection signatures to cover this indicator. Continuous re‑assessment is advised in case further malicious activity is observed.