www-groks-rewards[.]xyz

This domain, www-groks-rewards.xyz, is flagged as a cryptocurrency phishing distribution site targeting users with fraudulent token claims. Analysis indicates an elevated risk level due to its deceptive infrastructure and active exploitation of emerging cryptocurrency trends. The page title, $GROK DISTRIBUTION, suggests an attempt to impersonate legitimate token airdrops or reward programs, a common tactic in cryptocurrency-related phishing campaigns. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 15, 2026, and resolves to the IP address 188.114.96.3. Security vendor detections on VirusTotal report 14 out of 95 engines flagging the domain as malicious, while it appears on two independent security blocklists. Additional indicators include a Gridinsoft trust score of 0/100, confirming high-risk classification. Technologies detected on the site include particles.js, HSTS enforcement, Cloudflare Browser Insights, and HTTP/3, which may be leveraged to enhance perceived legitimacy or evade detection. To mitigate risks associated with cryptocurrency phishing distribution schemes, users should verify token airdrops through official project channels only. Network-level protections, such as blocking the domain and its resolving IP (188.114.96.3), should be implemented. Organizations are advised to monitor for indicators of compromise, including unusual outbound connections to the identified IP or registrant patterns associated with NICENIC INTERNATIONAL GROUP CO., LIMITED. Endpoint detection rules should be updated to include this domain and its associated artifacts to prevent credential theft or unauthorized token transfers.