groxtrade[.]com

Analysis of groxtrade.com indicates a high-risk phishing domain active as of July 19, 2026. The domain resolves to IP address 172.67.210.179, hosted under Cloudflare, Inc. (CA) with nameservers devin.ns.cloudflare.com and reza.ns.cloudflare.com. Registration details trace back to NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain returns an HTTP 200 status and presents a page titled 'Just a moment...', suggesting either a holding page or a Cloudflare interstitial, with no further content analysis available at this time. Security vendor data from VirusTotal shows 9 of 91 engines flagging the domain as malicious. The domain appears on one security blocklist and is referenced in 45 threat intelligence pulses on AlienVault OTX, indicating prior detection in phishing campaigns. The domain remains active and is currently blocked by PhishDestroy. Infrastructure analysis reveals reliance on Cloudflare services, which may obscure direct hosting details and complicate attribution. The SSL certificate is issued by Google Trust Services (WE1), a common practice for both legitimate and malicious sites. No specific brand impersonation or phishing kit is identified from the available data, limiting classification to generic phishing activity. Defenders should treat this domain as malicious based on current detections and block it at the DNS or proxy level. Further investigation may be required if the domain is observed in network logs, particularly to determine any targeted brands or campaign-specific indicators. Monitoring for changes in page content or additional detections is recommended.