grok49k[.]com

Analysis of the domain grok49k.com indicates active brand impersonation targeting Ethereum, with infrastructure evidence suggesting a high-risk phishing campaign. The domain was registered on March 13, 2026, through Internet Domain Service BS Corp and currently resolves to the IP address 192.142.10.5. Detection data from security vendors reveals that 7 of 95 engines flagged the domain as malicious, while it appears on two security blocklists, including PhishDestroy and BLP-Malware. The domain has also been documented in 23 threat intelligence pulses, further corroborating its association with malicious activity. The page title, 'GROK49K Official Website Presale (up to 200% bonus),' explicitly references a token presale, aligning with the identified phishing kit labeled 'Token Presale.' This suggests the site is designed to deceive users into participating in a fraudulent cryptocurrency offering under the guise of an Ethereum-affiliated project. The domain's trust score is 0/100, reinforcing its classification as high-risk. Technologies detected on the domain include WordPress, MySQL, PHP, LiteSpeed, and jQuery, which are commonly exploited in phishing infrastructure due to their widespread use and potential vulnerabilities. While the domain remains active as of July 12, 2026, defenders should prioritize blocking access to 192.142.10.5 and monitoring for related domains registered through the same registrar. The SSL certificate issued by Let's Encrypt does not mitigate the risk, as legitimate certificates are frequently abused in phishing campaigns. Given the domain's presence on multiple blocklists and its association with known malicious infrastructure, organizations are advised to treat this domain as a confirmed threat and implement appropriate countermeasures, including DNS filtering and endpoint protection updates.