gro83k[.]icu

PhishDestroy research shows that the domain gro83k.icu is actively pushing a credential theft kit. Visitors who enter usernames or passwords on this site risk having their accounts hijacked by malicious actors. The page is disguised to resemble a legitimate login portal, tricking users into surrendering sensitive credentials that can then be used for financial fraud or identity theft. Security teams advise treating any interaction with this domain as a potential compromise and taking immediate remediation steps. This domain was flagged by PhishDestroy after just 2 out of 95 VirusTotal security vendors detected harmful content on gro83k.icu. The domain itself was registered on May 5, 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED and currently resolves to IP address 172.67.138.215. The site also holds a valid SSL certificate issued by Google Trust Services, which attackers often use to appear more trustworthy and lower user suspicion. Despite the low initial detection rate, the combination of a newly created domain, a suspicious IP range, and an active campaign makes this site a significant threat. If you visited gro83k.icu and entered any login details, immediately change the password on that account and enable two-factor authentication where possible. Scan all devices that may have accessed the page using up-to-date antivirus software. Report the incident to your IT or security team so they can monitor for unusual activity. Avoid reopening the site; instead, rely on official channels to verify any requests for credentials. Staying vigilant and acting quickly limits the damage credential theft can cause.