gro31q[.]com

Analysis of the domain gro31q.com indicates an active phishing campaign targeting cryptocurrency users through a fraudulent token presale. The domain was registered on May 18, 2026, via Ultahost, Inc., and currently resolves to the IP address 99.83.231.61, which is associated with AWS Global Accelerator infrastructure in the United States. The domain's nameservers, mark.ns.cloudflare.com and nucum.ns.cloudflare.com, suggest the use of Cloudflare services for DNS management and potential obfuscation of hosting details. The page title, 'GRO31Q Official Website Presale (up to 200% bonus),' explicitly advertises a token presale with unrealistic financial incentives, a common tactic in cryptocurrency scams. The domain has been flagged by one threat intelligence pulse on AlienVault OTX and appears on at least one security blocklist, specifically PhishDestroy. Gridinsoft assigns a trust score of 0/100, further indicating malicious intent. As of the latest scan, four out of ninety-two security vendors on VirusTotal have detected this domain as malicious, though the absence of detections from other vendors does not confirm safety. The domain remains operational, serving content over HTTPS with a Let's Encrypt certificate (serial number E8). Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where cryptocurrency-related activities are common. Monitoring for related infrastructure, such as additional domains registered through Ultahost or resolving to the same IP, may help identify broader campaign activity. The exact content and functionality of the site have not been analyzed, but the advertised presale and bonus structure align with known fraudulent schemes in the cryptocurrency space.