grok15g[.]pro

This domain, grok15g.pro, is identified as a crypto investment scam designed to deceive victims into participating in a fraudulent token pre-sale. The site impersonates the GROK15G token, offering fabricated incentives such as "up to 200% bonus" to lure users into transferring cryptocurrency. Analysis indicates the presence of a crypto drainer mechanism, where victims are likely directed to connect wallets to malicious smart contracts that siphon funds upon interaction. No legitimate affiliation with the GROK15G project or its branding was observed, and the domain exhibits classic hallmarks of a high-pressure investment scam targeting cryptocurrency enthusiasts.

Technical indicators confirm the domain's malicious nature. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolves to the IP address 172.67.131.25, hosted on Cloudflare's infrastructure (AS13335). VirusTotal detection rates show 12 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and was previously blocked by Google Safe Browsing. The SSL certificate is issued by Google Trust Services (WE1), a common tactic used to lend false legitimacy to phishing sites. Infrastructure analysis reveals the use of Cloudflare, which is frequently leveraged to obfuscate the true origin of malicious domains and evade takedown efforts.

As of the latest assessment, grok15g.pro has been taken offline, likely due to enforcement actions by security providers or hosting interventions. However, the risk of reemergence remains elevated, as threat actors often redeploy similar domains or shift infrastructure to evade detection. Users who interacted with the site are advised to revoke any connected wallet permissions, monitor for unauthorized transactions, and report the incident to relevant blockchain security platforms. Organizations should update blocklists to include the domain and associated IP, while security teams are recommended to conduct retrospective analysis for any prior exposure to this infrastructure.