grokr-allocations[.]xyz

This domain, grokr-allocations.xyz, is flagged as a brand impersonation threat targeting Coinbase through a fraudulent token presale scheme. Analysis indicates the site was designed to deceive users into participating in a $GROK pre-sale, mimicking legitimate cryptocurrency offerings. The domain is currently classified under investigation for its role in this specific threat type, which involves unauthorized use of a trusted brand to solicit funds or credentials. Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited on November 01, 2025, and resolves to the IP address 188.114.96.3. It employs Cloudflare services and HTTP/3 protocol, with an SSL certificate issued by Google Trust Services. Despite its deceptive intent, the domain has not been flagged by any of the 95 vendors on VirusTotal, though it appears on one security blocklist. Gridinsoft assigns it a trust score of 0 out of 100, reflecting its high-risk nature. The page title explicitly states $GROK PRE-SALE, a clear indicator of its fraudulent token sale activity. As of the latest assessment, grokr-allocations.xyz has been taken offline, mitigating immediate user exposure. However, organizations and individuals are advised to monitor for similar domains leveraging the same registrar, IP range, or infrastructure patterns. Network administrators should block the identified IP address (188.114.96.3) and any associated domains registered through NiceNIC International Group Co., Limited during the relevant timeframe. Users should be educated on recognizing token presale scams, particularly those impersonating established cryptocurrency platforms, and verify all offers through official channels before engaging.