grok82c-fxempire[.]com

The domain grok82c-fxempire.com has been identified as a crypto drainer phishing site, specifically designed to trick users into connecting their cryptocurrency wallets under the guise of a presale for a project called GROK82C, which fraudulently claims to be backed by Elon Musk’s AI-blockchain vision. The site impersonates the legitimate financial news brand FXEmpire to lend itself credibility. Currently, the domain is offline and has been taken down, but it remains a threat indicator for similar future campaigns.

According to intelligence gathered, this domain was flagged by 1 out of 95 VirusTotal security vendors and appears on one security blocklist. It was registered through Ultahost, Inc. and created on May 22, 2026, resolving to IP address 75.2.60.5. The SSL certificate was issued by Let's Encrypt (E8), and AlienVault OTX recorded it in one threat intelligence pulse. The page title read "GROK82C Presale: Elon Musk’s AI-Blockchain Vision Captures Global Investor Imagination | FXEmpire," clearly indicating a crypto drainer scheme aimed at harvesting wallet credentials.

Given the elevated risk level and the specific threat of crypto drainer phishing, users should avoid any interaction with this domain or similar unsolicited presale offers. PhishDestroy recommends never connecting a cryptocurrency wallet to unknown sites and verifying any investment opportunity through official channels. If any credentials were entered, they should be considered compromised, and affected wallets should be monitored for unauthorized transactions. The domain is currently offline, but its registration details and indicators should be added to blocklists to prevent future access.