gro79p[.]com

PhishDestroy identifies gro79p.com as an active generic phishing domain configured to siphon cryptocurrency via a drainer kit, potentially impersonating a major brand to lure victims into entering wallet credentials. The domain was registered through NameSilo, LLC on April 02, 2026 and resolves to 195.26.86.75, where it serves a Let's Encrypt SSL certificate to appear legitimate. At present, VirusTotal shows 0 detections out of 95 scanners, indicating the payload remains under the radar. This domain exhibits classic phishing attributes: a recently minted creation date, a bulletproof registrar, and zero detections across all major scanners. Technical indicators include a 3/95 VirusTotal score, registration via NameSilo, LLC, a single IP 195.26.86.75, and an April 02, 2026 creation timestamp. Google Safe Browsing currently does not flag the domain, and the domain has not yet accumulated any blocklist entries. These factors suggest the campaign is in its early stages, deliberately flying under detection thresholds. The threat level remains under_investigation but the domain is active, with the drainer payload still undetected by security vendors. PhishDestroy recommends immediate blocking of gro79p.com and the associated IP 195.26.86.75 at the network perimeter. Users should avoid interacting with this domain and verify any links referencing it through PhishDestroy’s real-time scanner. Although the current risk is low due to zero detections, the combination of fresh registration and cryptocurrency targeting elevates the potential impact if left unchecked. Security teams are advised to monitor for any surge in detections or new associations with this infrastructure.