grok20g[.]net

The domain grok20g.net was registered on 21 February 2026 through NiceNIC International Group Co., Limited. It is currently flagged as a high‑risk generic phishing site. The page title returned from the HTTP response is “Nuts&Gears”, which does not correspond to a known legitimate brand and suggests a lure‑oriented landing page. Given the recent creation date and the absence of any historical reputation, the domain is likely being used for a short‑term phishing campaign.

Technical probing shows the domain resolves to IP 85.158.57.2, hosted in Poland under AS212238 (Datacamp Limited). The server presents a valid Let's Encrypt R13 certificate, and the DNS is served by Cloudflare name servers katelyn.ns.cloudflare.com and lex.ns.cloudflare.com. An HTTP 301 redirect is observed, indicating the site may forward visitors to a secondary location.

Threat intelligence indicates the domain appears on one public blocklist and has been blocked by the PhishDestroy filtering engine. Gridinsoft assigns a trust score of 0 / 100, and VirusTotal registers detections from 2 of 95 scanning engines, reinforcing the malicious assessment. No additional malware or command‑and‑control artifacts have been reported, and the exact content of the landing page has not been captured, leaving the specific phishing vector (credential harvest, credential‑stealing form, etc.) uncertain.

Defenders should add grok20g.net to outbound and inbound deny lists at the firewall and DNS resolver level. Continuous monitoring of DNS queries for the domain and its associated IP is advised, as the infrastructure could be repurposed for other malicious hosts. Where possible, sinkhole the IP address to disrupt any active campaign, and update intrusion‑detection signatures to flag the observed HTTP 301 response and the “Nuts&Gears” title pattern.