gro89k-cointelegraph[.]com

This domain, gro89k-cointelegraph.com, operates as a credential phishing site targeting cryptocurrency users by impersonating the legitimate news platform Cointelegraph. Analysis indicates the site presents a fake login interface designed to harvest user credentials, potentially leading to unauthorized access to digital wallets or exchange accounts. The threat extends to users who may unknowingly enter sensitive information, believing they are accessing a trusted news source for market updates or exclusive content. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. The site resolves to the IP address 192.142.10.5 and is currently flagged by 5 out of 95 security vendors on VirusTotal, including detection as a generic phishing threat. Additionally, the domain appears on one security blocklist and uses a Let's Encrypt SSL certificate, which, while providing encryption, does not validate the legitimacy of the site. The page title 'Account Suspended' suggests an attempt to mimic a legitimate service interruption, further deceiving visitors. Users who have visited gro89k-cointelegraph.com or entered credentials on the site should take immediate action to mitigate risks. First, cease all interaction with the domain and avoid clicking any links or downloading files from it. If credentials were entered, change passwords for all associated accounts, particularly cryptocurrency wallets and exchanges, and enable multi-factor authentication where available. Monitor financial accounts for unauthorized transactions and consider revoking access to any connected third-party applications. Reporting the domain to relevant security teams or platforms can help prevent further victimization.