gro45h[.]icu

The domain gro45h.icu poses a significant threat as it engages in brand impersonation, specifically targeting Google. This type of threat typically aims to deceive users into believing they are interacting with a legitimate Google site, thereby potentially harvesting sensitive information such as login credentials. The domain used the title 'Google' to further enhance its deceptive appearance, which can lead to unauthorized access to personal or corporate accounts if users are tricked into entering their credentials.

Gro45h.icu was created on May 27, 2026, and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain is currently offline and has been blocked by PhishDestroy after appearing on one security blocklist. The domain resolved to the IP address 142.251.155.119 and presented an SSL certificate issued by Google Trust Services, adding a layer of legitimacy to its appearance. On VirusTotal, 8 out of 95 security vendors flagged this domain as malicious. The technologies detected on the site included particles.js, Google Web Server, jsDelivr, HSTS, Cloudflare Browser Insights, and HTTP/3, suggesting an attempt to mimic legitimate Google infrastructure.

Users who have visited gro45h.icu should immediately perform a security check on their devices and online accounts. It is critical to change passwords, especially for accounts associated with Google services, and enable two-factor authentication if not already in place. Monitoring account activity for any unauthorized access is also recommended. Additionally, users should consider reporting the incident to their organization's IT department or a cybersecurity professional to assess further risks and implement preventive measures against similar threats in the future. This incident highlights the importance of remaining vigilant against online threats and verifying the authenticity of websites before entering any personal information.