growvex[.]info

The domain growvex.info was registered on May 27, 2026 through NameCheap, Inc. It currently resolves to the IPv4 address 64.20.38.212, which is associated with Interserver, Inc. The site returns HTTP status code 200 and presents a page titled “Grow Investment – Home | Learn, Trade and Earn Using our Grow Invest Intelligence Technology Today.” The content suggests an attempt to masquerade as a legitimate investment platform, leveraging financial‑technology terminology to lure victims.

Infrastructure analysis shows the domain is served using a Let’s Encrypt certificate issued for the year‑range “YR2,” indicating the TLS certificate was obtained recently. The authoritative name servers are dns2025a.trouble‑free.net and dns2025b.trouble‑free.net, both of which are commonly observed in malicious hosting configurations. The hosting provider, Interserver, Inc., is located in the United States, and the IP address 64.20.38.212 has been observed in other phishing campaigns targeting financial services.

Detection metrics confirm the malicious nature of the site. VirusTotal reports that 2 of 95 scanned security vendors flag the domain as malicious, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears on a single security blocklist and is actively blocked by PhishDestroy. The threat is classified as generic_phishing with a high risk level, and the current status is listed as active.

Defenders should add growvex.info to network‑level blocklists and configure URL filtering solutions to deny connections to the resolved IP address 64.20.38.212. Monitoring of the associated name servers and registrar activity is advised, as similar domains may be registered using the same NameCheap account. Incident response teams should treat any emails or messages referencing “Grow Investment” with heightened scrutiny and consider sinkholing the domain to disrupt further victim acquisition.