gro15k[.]icu

Analysis as of July 23 2026 flags gro15k.icu as an active high‑risk phishing site. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare’s network (AS13335) with the IP address 172.67.180.136 located in the United States. DNS resolution uses the Cloudflare nameservers guy.ns.cloudflare.com and stella.ns.cloudflare.com, and the site serves content over HTTPS with a certificate issued by Google Trust Services (WE1), indicating a valid TLS chain but offering no guarantee of legitimacy. HTTP requests return a 200 status and the page title “GRO15K Official Pre‑Sale — Get Up to 200% Bonus!” suggests a financial lure designed to entice victims with inflated bonuses.

Technical fingerprints include particles.js, jsDelivr and HTTP/3, all typical of modern web delivery but not indicative of benign intent. Reputation data shows the domain appears on one security blocklist and is actively blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reports that 13 of 93 scanning engines flag the domain as malicious, reinforcing the suspicion of phishing activity. Despite a valid SSL certificate, the combination of a fresh registration, low trust score, multiple vendor detections, and the promotional page title points to a coordinated attempt to harvest credentials or financial information.

Defenders should add gro15k.icu to URL filtering policies, block the associated IP 172.67.180.136 at the network perimeter, and monitor for outbound connections to Cloudflare‑served resources that match the observed technology stack. Continuous re‑scanning is advised, as the threat actor may modify the payload or hosting configuration. Until further evidence emerges, the domain should be treated as malicious and excluded from trusted lists.