grok26k[.]com

PhishDestroy identifies grok26k.com as an active credential theft phishing domain used to harvest user login details and sensitive information. The site remains under investigation but continues to operate with confirmed malicious intent. No specific brand impersonation has been confirmed at this stage of analysis.

This domain was flagged by 0 of 95 VirusTotal vendors as of the latest scan, indicating low detection despite its active threat status. grok26k.com is registered through Ultahost, Inc., resolves to IP 99.83.231.61, and holds a Let's Encrypt SSL certificate issued for web security obfuscation. The domain was created on May 17, 2026—a recent registration timeline suggesting opportunistic deployment. It has not yet appeared on major threat intelligence blocklists, and real-time trust scores remain uncompromised. However, the absence of detections should not be interpreted as safety, particularly given the active credential theft operation under investigation.

Authorities recommend immediate network and endpoint blocking of grok26k.com and IP 99.83.231.61. Organizations should audit outbound traffic to prevent data exfiltration and warn users against interacting with the domain. Deployments of browser-based security extensions that block known phishing vectors are strongly advised. Continuous monitoring via threat intelligence feeds for emerging blocks is essential. Administrators are urged to update firewall rules, DNS sinkholes, and email filtering systems to block all communications with the domain and associated infrastructure. Given the low VT detection rate, this domain represents a high-risk, high-impact threat vector requiring urgent containment action.