gro75k[.]cfd

Analysis of gro75k.cfd shows a newly registered domain (created March 06, 2026) that was actively serving a page titled "GRO75K Official Pre-Sale — Get Up to 100% Bonus!" before being taken offline. The site lacked an SSL certificate, indicating that traffic was unencrypted and that the operator did not invest in basic security hygiene. DNS resolution points to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc., a common hosting provider for both legitimate and malicious content. The domain is registered through NiceNIC International Group Co., Limited and uses the Cloudflare nameservers dakota.ns.cloudflare.com and paityn.ns.cloudflare.com.

VirusTotal scans recorded nine positive detections out of ninety‑four security vendors, confirming that multiple independent tools consider the domain malicious. It is listed on at least one public security blocklist and has been actively blocked by the PhishDestroy service. Current HTTP status is offline, but the historical presence of a pre‑sale bonus lure aligns with common phishing tactics that entice victims with exaggerated financial incentives.

Defenders should continue to block gro75k.cfd at network perimeter and DNS layers, add the domain to internal threat intelligence feeds, and monitor the associated IP address for any re‑use by other malicious actors. Given the Cloudflare hosting, any future relaunch could inherit the same IP range, so vigilance on traffic to 188.114.96.3 is advised. The lack of SSL, recent registration, and vendor detections collectively indicate a high confidence that gro75k.cfd was used for phishing, and the domain should be treated as hostile until proven otherwise.