grok-vance[.]ai-cryptolist[.]com

The domain grok-vance.ai-cryptolist.com is associated with a cryptocurrency scam and has been flagged by 13 out of 94 vendors on VirusTotal. Despite its current offline status, the domain's malicious nature is evident from these detections. It was hosted on an IP address managed by CloudFlare, Inc., located in Canada, and registered through Key-Systems GmbH.

This domain's SSL certificate was issued by Google Trust Services, suggesting an attempt to appear legitimate. The domain was created on April 11, 2026, indicating a future registration date, which might be an error or manipulation to evade detection systems. The presence of this domain on public blocklists, including PhishDestroy, further underscores its malicious intent.

Phishing domains like grok-vance.ai-cryptolist.com often exploit the gap between domain registration and antivirus database updates. This domain's rapid detection by PhishDestroy highlights the effectiveness of early threat identification systems in capturing threats before they propagate widely. The combination of a reputable SSL issuer and a credible registrar suggests a sophisticated attempt to deceive users into trusting the site.

Although the domain is currently offline, its past activity and detection by multiple security vendors affirm the need for continued vigilance against such scams. The use of a Canadian IP and CloudFlare's infrastructure might have been intended to obscure the domain's true origins and intentions, complicating efforts to trace and mitigate its impact.