grok15k[.]com

Analysis of grok15k.com shows an active phishing infrastructure that was brought offline prior to this report. The domain was registered on 27 February 2026 through NameSilo, LLC and resolves to the IPv4 address 195.66.213.55. That address is assigned to SOLLUTIUM EU Sp z.o.o. in the Netherlands and is announced by ASN 43641.

No TLS certificate was observed for the domain, meaning any client connections would be unencrypted HTTP. When accessed, the site returned a generic placeholder with the page title "Default Web Site Page," indicating that the landing page either never hosted malicious content or was removed before capture. VirusTotal scans recorded a single detection out of ninety‑three security vendors, and the domain appears on one external blocklist. PhishDestroy has also listed the domain, and the current status flag indicates that the site has been taken offline.

The available evidence does not disclose a targeted brand, specific phishing kit, or credential‑harvesting form, and there are no publicly shared URLs or payload samples linked to this domain. Consequently, the precise attack vector and victim profile remain uncertain. Defenders should continue to block grok15k.com at DNS and perimeter firewalls, monitor the associated IP address for any re‑use, and incorporate the domain into threat‑intel feeds. Ongoing vigilance is advised, especially for any future resolution of the domain or similar placeholders that may be re‑activated for phishing campaigns.