grok35k[.]icu

This domain, grok35k.icu, is an active phishing site designed to steal user credentials such as usernames, passwords, and potentially multi-factor authentication codes. The site mimics legitimate login portals, often impersonating well-known services or platforms, to trick visitors into entering sensitive information. Once submitted, this data is captured by threat actors and can be used for unauthorized account access, identity theft, or further malicious campaigns targeting the victim or their contacts. Analysis indicates this domain was registered on March 13, 2026, through NiceNIC International Group Co., Limited. As of the latest scan, 6 out of 95 security vendors on VirusTotal have flagged grok35k.icu as malicious, and it appears on at least one security blocklist. The site is hosted behind Cloudflare infrastructure, resolving to the IP address 188.114.97.3, and uses HTTP/3 for communication. The page title, Suspected phishing site | Cloudflare, suggests the hosting provider has detected and labeled the content as suspicious, though the site remains accessible in some regions. If you or someone in your network has visited grok35k.icu and entered any credentials, immediate action is required. First, change the passwords for any accounts accessed or entered on the site, prioritizing email, financial, and work-related platforms. Enable multi-factor authentication if not already active. Monitor these accounts for unusual activity, such as unauthorized logins or transactions. Run a full scan on any device used to access the site to check for malware or keyloggers. Report the incident to your organization's security team or a trusted cybersecurity professional for further guidance. Avoid clicking on any links or downloading attachments from unexpected messages, even if they appear to come from known contacts.