grokius[.]lat

Analysis as of July 22 2026 indicates that the domain grokius.lat is currently taken offline but retains a footprint that warrants elevated risk classification. The domain resolves to IP 172.67.194.123, an address owned by AS13335 Cloudflare, Inc., located in the United States. No TLS certificate is presented, meaning HTTPS connections would be unencrypted or would fail, which aligns with the observed page title “Just a moment…”. The authoritative nameservers are liv.ns.cloudflare.com and michael.ns.cloudflare.com, confirming Cloudflare as the DNS provider. Registrar information shows the domain was registered on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com.

The relatively recent creation date suggests a short‑lived infrastructure typical of opportunistic phishing campaigns. The site has been listed on three security blocklists and is blocked by the PhishDestroy, MetaMask, and SEAL filters, indicating that multiple threat‑intelligence feeds have flagged it as malicious. VirusTotal scans returned two positive detections out of ninety‑three scanners, reinforcing the suspicion that the domain is being used for fraudulent purposes. Because the site is offline, active payloads cannot be confirmed, and the exact spoofed brand or service remains unknown; the only observable artifact is the generic “Just a moment…” title. Consequently, attribution of a specific target is uncertain.

Defenders should continue to enforce deny‑list rules for grokius.lat at network perimeter devices, DNS resolvers, and endpoint protection solutions. Monitoring for any re‑hosting of the same IP address or reuse of the Cloudflare nameservers may reveal a resurrection of the infrastructure. Organizations that employ threat‑intel platforms should ingest the blocklist entries and the two VirusTotal detections to improve detection coverage. Given the Cloudflare hosting, the operator can rapidly redeploy, so periodic re‑evaluation of the domain’s status is recommended.