groovecf[.]com

The domain groovecf.com has been identified as a credential theft phishing site targeting users of an entertainment platform. Analysis confirms the domain is currently offline, though prior activity involved luring victims with promises of interactive experiences, likely to harvest login credentials or financial information. The page title, "超凡国际官网入口 - 智能娱乐体验，开启全新互动时代," suggests impersonation of a legitimate gaming or entertainment service, though no specific brand name was confirmed in available intelligence. Infrastructure analysis reveals the domain was registered on February 12, 2025, through Gname.com Pte. Ltd. It resolves to the IP address 156.227.104.138, hosted in Hong Kong under AS139880 (OWGELS INTERNATIONAL CO., LIMITED). The domain appears on one security blocklist and is flagged by 20 of 95 security vendors on VirusTotal. Google Safe Browsing classifies it as phishing, and the SSL certificate is issued by Let's Encrypt (R13). Additional indicators include a single blocklist entry and a high-risk classification from PhishDestroy. Current status indicates the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Organizations are advised to block the domain and associated IP (156.227.104.138) at the perimeter, monitor for credential reuse attempts, and review logs for connections to the domain or IP. End users should reset credentials if they accessed the site and enable multi-factor authentication on related accounts. Security teams are encouraged to correlate this indicator with other phishing campaigns targeting entertainment or gaming platforms.