groked-allocation[.]xyz

The domain groked-allocation.xyz is currently active and classified as a brand impersonation threat specifically targeting Coinbase, a major cryptocurrency exchange platform. Analysis of the domain reveals it is designed to deceive users by mimicking legitimate Coinbase services, likely through a fraudulent $GROK pre-sale offer displayed in the page title. This type of threat typically aims to harvest credentials, payment details, or cryptocurrency deposits under false pretenses. Infrastructure analysis provides concrete indicators of malicious intent. The domain is flagged by 6 of 95 security vendors on VirusTotal, indicating moderate detection but sufficient concern to warrant caution. It was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolves to the IP address 172.67.162.248. The SSL certificate is issued by Google Trust Services under the WE1 root, which does not inherently validate legitimacy. The domain appears on one security blocklist, further corroborating its suspicious status. The creation date suggests a recent deployment, aligning with common phishing campaign timelines. Current status remains active, and the risk level is elevated due to the combination of brand impersonation, low detection but non-zero blocklist presence, and the use of cryptocurrency-themed lures. Organizations and individuals are advised to block this domain at the network level and add it to endpoint protection denylists. Users should be educated to recognize the $GROK pre-sale scam theme and verify all cryptocurrency offers directly through official Coinbase channels. Security teams are recommended to monitor for related domains using similar naming patterns or infrastructure, particularly those leveraging NiceNIC registrations or the same IP range.