gro79p[.]net

This domain, gro79p.net, is identified as a fake login phishing portal designed to harvest user credentials. Analysis indicates it is currently offline, though it was actively used in credential theft campaigns prior to takedown. No specific brand impersonation has been confirmed, but the domain exhibits characteristics typical of generic phishing infrastructure targeting login pages for financial or email services. Infrastructure analysis reveals the domain was registered through NameSilo, LLC on April 03, 2026, an unusually future-dated creation that may indicate domain generation algorithm (DGA) abuse or registry manipulation. It resolves to the IP address 195.26.86.75, which has been associated with other malicious activity. The domain is flagged by 4 of 95 security vendors on VirusTotal, appears on 1 security blocklist, and holds a Gridinsoft trust score of 0/100. These indicators confirm its malicious classification and elevated risk level. Current status shows gro79p.net has been taken offline, though residual risk remains due to potential reuse of the IP or registrar for future malicious domains. Organizations are advised to block the domain and its associated IP at the perimeter firewall and DNS levels. Security teams should review logs for connections to 195.26.86.75 or gro79p.net between April 2026 and present, particularly for credential submission attempts. Users who may have interacted with the domain should reset passwords for any accounts accessed during the exposure window and enable multi-factor authentication where available. Monitoring for similar domains registered via NameSilo with future-dated creation timestamps is recommended as part of proactive threat hunting.