grok73k-fxempire[.]com

This domain, grok73k-fxempire.com, is identified as a fraudulent cryptocurrency presale platform designed to impersonate Elon Musk and promote a fictitious AI-blockchain investment opportunity labeled GROK73K. Analysis of the page title, "GROK73K Presale: Elon Musk’s AI-Blockchain Vision Captures Global Investor Imagination | FXEmpire," indicates an attempt to deceive victims by leveraging high-profile branding and fabricated urgency around a non-existent token presale. No direct evidence of a crypto drainer kit was observed, though the infrastructure aligns with common phishing tactics targeting cryptocurrency investors through fake investment portals.

Technical indicators confirm the domain’s malicious nature. VirusTotal reports 2 out of 95 security vendors flagging the domain as malicious. The domain was registered on June 2, 2026, through Ultahost, Inc., and resolves to the IP address 99.83.231.61. It appears on one security blocklist and was hosted using Netlify, with additional technologies including HSTS, Google Tag Manager, and Google Analytics detected. The domain’s creation date is notably in the future, suggesting potential typosquatting or a fabricated registration record to evade immediate detection. No Google Safe Browsing (GSB) listing was observed at the time of analysis.

The domain has since been taken offline, likely due to enforcement actions by security providers. However, residual risk remains for users who may have interacted with the site prior to its removal. Victims are advised to revoke any wallet permissions granted to unknown contracts and monitor accounts for unauthorized transactions. Organizations should update blocklists to include the domain and associated IP, while users should verify investment opportunities through official channels only. The use of fabricated presale narratives and high-profile impersonation underscores the need for heightened scrutiny of cryptocurrency-related promotions.