grow-right[.]ltd

The domain grow-right.ltd was registered on February 21, 2026 and is currently reported as taken offline. DNS resolution points to the IP address 198.251.88.6, which is announced by AS53667 FranTech Solutions and geolocated to the United States. The authoritative nameservers are ns1.my-control-panel.com and ns2.my-control-panel.com, indicating the use of a generic control‑panel hosting service. The site’s HTML title tag reads "grow-right.ltd," providing no additional context about the content or intended victim demographic. No SSL certificate is associated with the domain, leaving the HTTP connection unencrypted and exposing any transmitted credentials to interception.

Threat intelligence flags the domain as a generic phishing indicator. It appears on three public blocklists and is specifically blocked by the PhishDestroy, MetaMask, and SEAL filtering platforms. VirusTotal analysis shows that 2 of 95 security vendors have flagged the domain, suggesting that at least a minority of scanners have identified malicious characteristics. The absence of a certificate, combined with the blocklist presence and the limited VirusTotal detections, aligns with typical infrastructure used for credential‑harvesting campaigns. Uncertainty remains regarding the exact phishing payload, target brand, or victim interaction flow because the page content has not been captured.

Defenders should continue to block connections to 198.251.88.6 and add grow-right.ltd to URL filtering rules. Monitoring of the associated nameservers and ASN for any reactivation is advisable. Since the domain is offline, threat actors may redeploy the same infrastructure under a new domain; therefore, threat‑intel teams should watch for similarly configured domains using the same nameserver pattern or ASN. Continuous re‑evaluation of blocklist status and periodic VirusTotal rescans are recommended to capture any changes in malicious activity.