What Gridinsoft observed on Growbit247.org
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260901225100-97215820
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Fake Investment/Earning Website
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The independent current first-party review supports classifying growbit247.org as a Fake Investment/Earning Website. The live financial site presents apparent customer withdrawals, while its own JavaScript randomly combines names, countries, and fixed monetary amounts to manufacture each claim without a transaction source. It solicits investment accounts, cryptocurrency funding, withdrawals, identity data, contact details, and passwords while claiming global regulation without naming a legal operator, licence, regulator, or jurisdiction. Its pages also mix growbit247.org, growbit247.com, grwobit.com, newdawnpips.online, a Philippine WhatsApp number, Indonez demo assets, Profit Inc metrics, and Bitcoin-to-Thai-Baht terms under Georgia law. These exact current observations provide a first-party deceptive-behavior basis stronger than the prior broad Suspicious Website label. No malware payload, exploit, automatic download, payload hash, or execution trace was found; this category describes the deceptive financial solicitation, not malware distribution or an external blacklist alone.
Analyst findings
Review 9 documented observations View evidence
The live apex returned HTTP 200 and the current homepage identified itself as Grow Bit 24/7. The login, registration, password-reset, and terms routes also returned HTTP 200. The root and dashboard surfaces were therefore reviewed as live content rather than inferred from a blacklist or archive.
-
HTTP status
https://growbit247.org/ returned HTTP 200 with the title Grow Bit 24/7. -
HTTP status
https://growbit247.org/dashboard/login.php returned HTTP 200. -
HTTP status
https://growbit247.org/dashboard/register.php returned HTTP 200. -
HTTP status
https://growbit247.org/dashboard/tandc.php and /dashboard/reset-password.php returned HTTP 200.
The live homepage described the service as a multi-regulated global forex and cryptocurrency broker and promoted account opening, investment, trading, cryptocurrency funding and withdrawals, derivatives, and CFDs. It claimed global licensing and regulation and displayed large account, trade, and volume metrics.
- Page element Headline: Multi-regulated Global Forex and Crypto Broker.
- Page element Claim: Globally Licensed & Regulated.
- Page element The homepage promoted account registration, login, investing, trading, deposits, withdrawals, cryptocurrency payments, derivatives, and CFDs.
- Page element The page displayed $76+ billion monthly volume, 1.6+ million registered accounts, and 48+ million annual trades.
The live homepage presented pop-up messages that appeared to report recent customer withdrawals. Its own inline JavaScript instead selected a random person, country, and amount from fixed arrays and assembled the statement that the selected person had just withdrawn the selected amount. The displayed claims were therefore generated client-side without a transaction source.
- Analyst observation The page defined fixed listPerson, listCountries, and listPlans arrays; listPlans included $500.95, $1550.55, $10500.35, $10700.75, and other exact amounts.
- Analyst observation The script used Math.random() independently to select one person, one country, and one amount from those arrays.
- Analyst observation The script concatenated the random values into the message: person from country just withdrew amount.
- Page element The withdrawal pop-up had no server-provided transaction identifier, account reference, timestamp, or transaction data source.
The live broker presentation contained multiple unrelated identities. Its contact link used growbit247.com, social metadata used grwobit.com, a customer-contact widget used newdawnpips.online and a Philippine WhatsApp number, and broker graphics loaded from an Indonez Profit demo. The large trading metrics were expressly attributed to Profit Inc rather than Grow Bit 24/7.
- Page element The navigation contact address was [email protected] while the reviewed host was growbit247.org.
- Page element Open Graph metadata used grwobit.com and https://grwobit.com/img/logo.png.
- Analyst observation The live contact widget configured WhatsApp +639638109314 and email [email protected].
- Page element Multiple graphics loaded from https://www.indonez.com/html-demo/Profit/.
- Page element The page qualified its headline metrics as data based on year-to-date Profit Inc activity, last updated at the end of Q2 2020.
The live dashboard exposed login, registration, and password-reset forms. Registration requested first and last name, username, country, currency, email address, WhatsApp number, password, and password confirmation. Login requested email and password, while password reset requested an email address. No form was submitted and no account was created.
- Analyst observation Registration posted to /dashboard/register.php and requested first name, last name, username, country, currency, email, WhatsApp number, password, and password confirmation.
- Analyst observation Login posted email and password to /dashboard/login.php.
- Analyst observation Password reset posted an email address to /dashboard/reset-password.php.
- Analyst observation No registration, login, password reset, personal-data submission, deposit, withdrawal, or transaction was performed.
The live terms described Bitcoin transfers rather than a clearly identified regulated brokerage relationship. They made the customer responsible for destination details, disclaimed reimbursement for funds sent to an unintended destination, allowed expired orders to be recalculated using a Bitcoin-to-Thai-Baht rate, and selected Georgia law and courts near Atlanta. The page did not name the operating legal entity.
- Page element The terms said account details shown in the order summary would be the final transfer destination.
- Page element The terms said funds transferred to an unintended destination would not be reimbursed and no additional funds would be transferred.
- Page element For expired orders, the company reserved the right to recalculate the Bitcoin to Thai Baht exchange rate.
- Page element The terms selected the laws of the State of Georgia and courts located in or near Atlanta, Georgia.
- Page element No operating legal entity was named in the reviewed terms.
Despite the live claim of global licensing and regulation, the reviewed public pages did not identify a legal operating entity, licence number, regulator, regulated jurisdiction, or verifiable office. Risk text mentioned a Product Disclosure Statement and Financial Services Guide, but the reviewed navigation did not provide either document.
- Page element The reviewed public pages did not name a legal operator, licence identifier, regulator, regulated jurisdiction, or verifiable office.
- Page element Risk text mentioned a Product Disclosure Statement and Financial Services Guide, but the reviewed navigation linked neither document.
- Analyst observation No first-party licence evidence was located on the reviewed homepage, about page, dashboard registration page, or terms page.
Public history established that this broker surface persisted across multiple deployments. Wayback preserved seven successful apex, page, or asset records from September 2024 through April 2026, and urlscan.io indexed successful apex scans in June 2023 and April 2026 without a recorded verdict. OTX had no pulse, while exact indexed sandbox and threat-intelligence searches did not expose an exact harmful sample. These absences are incomplete-index results, not proof of safety.
- Analyst observation Wayback preserved seven successful apex, about-page, or static-asset records from 2024-09-05 through 2026-04-14.
- Analyst observation urlscan.io indexed successful apex scans on 2023-06-22 and 2026-04-23 without a recorded urlscan verdict.
- Analyst observation OTX returned zero threat pulses, and the current public OpenPhish feed had no exact growbit247.org entry.
- Analyst observation Indexed exact-host searches exposed no exact object in ANY.RUN, Hybrid Analysis, Joe Sandbox, URLhaus, ThreatFox, PhishTank, OpenPhish, or Triage.
The reviewed live and historical surface did not supply an automatic executable or archive download, a confirmed unrelated credential receiver, an exploit, a malware file, a payload URL, a payload hash, or an observable malware execution trace. The Fake Investment/Earning Website conclusion concerns the exact deceptive financial presentation, not malware distribution and not a blacklist label standing alone.
- Analyst observation No automatic executable or archive delivery, exploit, malware file, payload URL, payload hash, or malware execution trace was reproduced.
- Analyst observation The classification basis is the live client-generated withdrawal claims and the financial identity contradictions on exact reviewed pages.
- Analyst observation A domain-level blacklist category was not treated as evidence that a particular URL or file executed harmful code.
Scope and limitations
- The review covered the live apex and www host, homepage, about page, dashboard login, registration, password-reset and terms routes, navigation, forms, scripts, DNS, TLS, public history, URL-scanner results, threat-intelligence indexes, sandbox indexes, and current public blacklist context.
- No account was created, no registration, login, password-reset, personal-data, deposit, withdrawal, trade, or support request was submitted, and no customer transaction outcome was independently verified.
- Authenticated account pages, payment processors, cryptocurrency wallets, bank accounts, server logs, databases, source repository, operator records, customer records, and administrative systems were not accessed.
- The review did not establish the real-world identity of the operator, a verified victim loss, criminal conduct, law-enforcement action, or the authenticity of any claimed account, trade, volume, deposit, or withdrawal result.
- Public search, sandbox, URL-scanner, threat-intelligence, certificate, Common Crawl, and archive coverage is incomplete. Sources requiring authorization, returning errors, or lacking an exact record were treated as unknown rather than clean.
- No malware executable, archive, exploit, payload URL, payload hash, automatic download, or malware execution trace was established. A future exact URL, file, account capture, transaction record, or materially changed deployment requires object-specific review.
