growegarden[.]netlify[.]app

Analysis of growegarden.netlify.app indicates an active brand impersonation campaign targeting Roblox. The site was registered on June 14, 2026 and is hosted on Netlify with HSTS enabled. DNS resolution points to IP 63.176.8.218, an AWS EC2 instance in the eu-central-1 region (Germany). The domain presents a DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate, confirming a valid SSL chain but offering no credibility assurance. The page title "Grow Garden Roblox Generator" aligns with the reported brand target, Roblox, confirming the impersonation intent. Infrastructure signals include a Gridinsoft trust score of 0/100 and a single entry on a security blocklist, with PhishDestroy already blocking the domain. No further page content has been publicly disclosed, leaving the specific malicious payload or credential collection mechanisms unverified. Defenders should consider immediate domain-level blocking, monitor traffic to the associated IP range, and update detection rules to flag URLs containing "growegarden" or the Netlify hosting pattern. Continued observation is advised while the investigation remains open.