grok65gsale[.]com

The domain grok65gsale.com is currently active and has been classified as a high-risk generic phishing site. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and first appeared in threat feeds shortly after registration. Its age of less than six months and immediate appearance on security blocklists indicate an intent to exploit unsuspecting users quickly.

Infrastructure analysis shows the domain resolves to the IPv4 address 85.158.57.2, which is allocated to AS212238 Datacamp Limited and geolocated in Poland. DNS resolution is handled by the Cloudflare nameservers carlos.ns.cloudflare.com and zita.ns.cloudflare.com. The web server returns an HTTP 301 redirect and presents a TLS certificate issued by Let’s Encrypt (R13), confirming the use of standard encryption but offering no indication of legitimate ownership.

Threat intelligence sources have recorded a single vendor detection on VirusTotal, with 1 of 95 scanners flagging the domain as malicious. The domain is listed on at least one public blocklist and has been actively blocked by the PhishDestroy filtering service. The page title returned from the server is "Privacy error", suggesting that the site may be misconfigured or deliberately presenting a generic error page to obscure its malicious payload.

The exact content hosted at grok65gsale.com has not been publicly disclosed, and no specific targeted brand or credential-capture template has been identified. Consequently, defenders should treat any traffic to this domain as hostile. Recommended mitigation steps include adding the domain to network-level blocklists, enforcing DNS sink-hole policies for the associated IP range, and monitoring for any authentication attempts that may be directed to the site. Ongoing observation of the domain’s DNS and SSL changes is advised, as threat actors frequently modify infrastructure to evade detection.