gro91h[.]icu

Analysis of the domain gro91h.icu indicates it was registered on February 21 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare‑hosted address 188.114.97.3, which is associated with ASN 13335 in the United States. The site presented a page titled “GRO91H Official Pre‑Sale — Get Up to 200% Bonus!” and did not present an SSL certificate, suggesting the connection was unencrypted. The domain appears on a single security blocklist and has been flagged by PhishDestroy, confirming that at least one reputable anti‑phishing service has taken action.

VirusTotal scans show that 16 of 93 security vendors identified the domain as malicious, providing moderate consensus of compromise. Nameserver records point to pete.ns.cloudflare.com and sima.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. Current status is offline, preventing live verification of the page’s content or any credential‑harvesting mechanisms; the exact payload or user‑interaction flow remains unverified.

Defenders should treat the domain as a confirmed phishing vector targeting users with a pre‑sale bonus promise, block the domain and its resolving IP at perimeter filters, and monitor for any related sub‑domains or newly registered look‑alikes. Ongoing surveillance of Cloudflare‑origin IP ranges for similar activity is advised, as is periodic re‑query of VirusTotal and blocklist feeds to capture any changes in detection scores. Organizations should also enforce TLS‑only policies to mitigate exposure to unencrypted malicious sites and consider adding gro91h.icu to internal threat‑intel feeds for correlation with user‑reported incidents.