grok49k-cointelegraph[.]com

This domain, grok49k-cointelegraph.com, is currently flagged as an active phishing infrastructure targeting cryptocurrency users. Analysis indicates the site presents itself as a token presale for an asset labeled GROK49K, with the page title explicitly stating 'Elon Musk Officially Launches GROK49K Presale.' While the domain name incorporates elements resembling a well-known cryptocurrency news outlet, no direct evidence confirms an official association with that brand or Elon Musk. The exact content and mechanics of the scam remain unconfirmed, though the presence of a 'Token Presale' phishing kit suggests an attempt to deceive users into transferring funds under false pretenses. Infrastructure analysis reveals the domain was registered on March 13, 2026, through Internet Domain Service BS Corp, and resolves to the IP address 192.142.10.5. It is hosted on a server running WordPress, MySQL, PHP, Vue.js, LiteSpeed, and jQuery, alongside Google Tag Manager and Google Analytics, which are commonly used for tracking user interactions. The domain is detected by 13 out of 95 security vendors on VirusTotal and appears in 23 threat intelligence pulses on AlienVault OTX, indicating widespread recognition as malicious. It is also blocked by at least two security systems, further corroborating its classification as a high-risk threat. The SSL certificate issued by Let's Encrypt provides encryption but does not validate the legitimacy of the site. Defenders should treat this domain as actively malicious, particularly in environments where cryptocurrency transactions occur. Network-level blocking of the domain and its resolving IP is recommended, along with monitoring for related infrastructure that may reuse the same hosting provider or registration patterns. Given the domain's recent creation and persistent activity, it is likely part of an ongoing campaign rather than an isolated incident. No evidence currently suggests this infrastructure has been taken down or abandoned.