gro68v[.]com

PhishDestroy identifies gro68v.com as a credential harvesting endpoint detected during routine threat hunting operations. This domain is not directly mimicking a well-known brand, suggesting a generic but targeted lure. The site appears to leverage a drainer kit designed to capture user credentials under the guise of a legitimate service, though no specific brand affiliation has been confirmed at this stage. The infrastructure is currently active, and the threat remains under qualitative assessment to determine the full scope of impersonation and exfiltration mechanisms in play.

Technical indicators corroborate the site’s malicious intent. VirusTotal reports 8/95 detection coverage as of the latest scan, indicating limited antivirus adoption against this strain. The domain resolves to IP 159.100.6.19, hosted on infrastructure associated with low-reputation autonomous systems. Registered through NameSilo, LLC on April 03, 2026, the domain has not yet been flagged by Google Safe Browsing. Additionally, public blocklists show zero detections thus far, underscoring the novel nature of this campaign and the need for proactive blocking.

The domain remains flagged with an ‘active’ status and ‘under_investigation’ risk level. No active blocking recommendations are currently enforced due to the absence of known blocklist entries. SOC teams are advised to flag gro68v.com at the network perimeter and DNS level. As the investigation progresses, further indicators of compromise will be published. The current risk is classified as pending, pending additional intelligence and behavioral analysis.