groupman[.]net

This domain, groupman.net, is flagged as a high-risk generic_phishing threat targeting cryptocurrency investors through an ICO-themed landing page. Analysis indicates the domain was designed to deceive users into participating in fraudulent initial coin offerings, leveraging social engineering tactics to extract sensitive information or funds. The page title, 'ICO Landing Page 2 - My Blog,' further supports this assessment, as it mimics legitimate ICO promotion sites commonly used in phishing campaigns. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NameSilo, LLC, and resolves to the IP address 209.124.66.7. Security vendor detections on VirusTotal report 12 out of 95 engines flagging the domain as malicious, while it appears on four distinct security blocklists. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its accessibility. Additional technical indicators include the use of LiteSpeed web server technology, HSTS enforcement, and HTTP/3 protocol support. The domain has been assigned a trust score of 0/100, and it is actively blocked by multiple security mechanisms, including MetaMask, SEAL, PhishDestroy, and InversionDNS. Mitigation steps for this specific threat type include immediate blocking of the domain and its associated IP (209.124.66.7) at the network perimeter. Organizations should ensure endpoint protection systems are updated to recognize the domain and its indicators of compromise. Given the ICO phishing context, user awareness training should emphasize the risks of interacting with unverified cryptocurrency investment pages, particularly those hosted on recently registered domains. Network logs should be reviewed for any prior connections to groupman.net or its IP, and affected systems should undergo forensic analysis to detect potential credential theft or unauthorized transactions. Proactive monitoring for similar domains registered through NameSilo or resolving to the same IP range is recommended to prevent follow-up attacks.