grvt[.]io-ref[.]lat

This domain is flagged as a cryptocurrency scam targeting users of the GRVT on-chain investment and trading platform. The site presents itself as a legitimate trading application, likely designed to trick visitors into connecting their crypto wallets. Once connected, malicious scripts may automatically drain funds or harvest private keys, a tactic known as a crypto drainer. The page title explicitly mimics GRVT’s branding, increasing the risk of deception for users seeking the genuine service. Analysis indicates this infrastructure was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on March 18, 2026, an unusually future-dated creation that may suggest domain spoofing or registry manipulation. The domain resolves to IP address 188.114.96.3 and is hosted behind Cloudflare, a common obfuscation technique used to conceal the true origin of phishing sites. Security vendors on VirusTotal have flagged grvt.io-ref.lat as malicious, with 14 out of 95 engines detecting it as harmful. The SSL certificate is issued by Let’s Encrypt, providing a false sense of security while the underlying content remains fraudulent. Technologies detected include Bootstrap for frontend design and Cloudflare Browser Insights for performance tracking, further aligning with typical phishing site characteristics. If you visited grvt.io-ref.lat or interacted with its content, immediately disconnect any connected wallets and revoke permissions using a blockchain explorer or wallet management tool. Scan your device for malware, as some crypto drainers deploy additional payloads. Monitor your wallet transactions for unauthorized activity and consider migrating funds to a new wallet if credentials were exposed. Report the domain to your wallet provider and relevant security platforms to assist in takedown efforts. Users should verify the authenticity of trading platforms by cross-referencing official domains and avoiding links from untrusted sources.