grokico[.]net

PhishDestroy identifies grokico.net as a credential-phishing domain engineered to harvest login credentials under the guise of a fake service portal. Threat actors registered the domain on July 27, 2025 through InterNetX GmbH and aligned it with IP 217.160.0.162 to serve spoofed pages mimicking well-known brands. The landing pages prompt victims to submit usernames, passwords, and two-factor codes, directly exposing accounts to takeover and enabling subsequent financial fraud. This domain was flagged by PhishDestroy under active investigation for credential phishing after VirusTotal engines returned 0 positive detections out of 95 scans, indicating zero coverage from current antivirus signatures. The domain was created July 27, 2025, is sponsored by InterNetX GmbH, and resolves to 217.160.0.162. Security teams have already logged multiple abuse reports, but the site remains online and actively collecting credentials. If you visited grokico.net and entered any information, immediately change the password on that account and enable a hardware security key or app-based second factor. Review account activity for unauthorized logins and report suspicious transactions to your bank. Disconnect any devices that may have cached the page and run a full antivirus scan using an up-to-date scanner. Forward the URL to PhishDestroy’s abuse channel for takedown acceleration.