grok87k[.]org

Analysis of the domain grok87k.org indicates active phishing infrastructure targeting users through a fraudulent pre-sale event. The domain, registered on April 7, 2026, via Internet Domain Service BS Corp, resolves to IP address 98.84.224.111 and is currently flagged by multiple security sources. Four of 95 security vendors on VirusTotal classify the domain as malicious, while it appears on two security blocklists, including PhishDestroy and BLP-Malware. The page title explicitly promotes a 'GROK87K Official Website — Pre-Sale Event (Receive Up to 200% Bonus),' suggesting an attempt to impersonate a legitimate token or cryptocurrency offering. Infrastructure analysis reveals the use of WordPress, MySQL, PHP, and jQuery, alongside Tidio for customer interaction and Netlify for hosting or asset delivery. The domain employs a Let's Encrypt SSL certificate, a common tactic to appear legitimate, while HSTS is enforced, potentially to evade basic security warnings. Gridinsoft assigns a trust score of 0/100, and AlienVault OTX includes the domain in 16 threat intelligence pulses, further corroborating its malicious classification. Defenders should prioritize blocking the domain and its resolving IP at network and endpoint levels. Given the pre-sale theme, users may be lured into disclosing wallet credentials or transferring funds under false pretenses. The exact nature of the scam—whether a token sale, airdrop fraud, or wallet drainer—remains unconfirmed without further page analysis, but the infrastructure and indicators strongly align with high-risk phishing activity. Monitoring for related domains registered through the same provider or resolving to the same IP may uncover additional threats in this campaign.