www-grok-presales[.]xyz

This domain, www-grok-presales.xyz, operates as a fraudulent cryptocurrency presale platform targeting users of the $GROK token. Analysis indicates the site functions as a crypto drainer, designed to deceive victims into connecting their wallets under the guise of participating in a token presale. Once connected, the site executes unauthorized transactions, siphoning funds directly from the victim’s wallet to attacker-controlled addresses. The page title, $GROK PRE-SALE, explicitly mimics legitimate token sale events, leveraging the popularity of the $GROK memecoin to increase credibility and lure potential victims.

Technical evidence confirms the malicious nature of this domain. The site is flagged by 10 out of 95 security vendors on VirusTotal, with detection labels including phishing, crypto scam, and wallet drainer. Registered on February 21, 2026, through NiceNIC International Group Co., Limited, the domain resolves to IP address 188.114.96.3, hosted on Cloudflare’s network (AS13335). Infrastructure analysis reveals the absence of an SSL certificate, a common red flag for phishing sites. The domain appears on four security blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL, further corroborating its malicious intent. The creation date, set in the future (2026), suggests an attempt to evade immediate detection by domain age-based filtering systems.

Users who visited www-grok-presales.xyz or connected a wallet to the site should assume their funds are at risk. Immediate action is required: revoke any active wallet connections to the domain via wallet settings or dedicated revoke tools. Scan the connected device for malware using updated security software to rule out additional compromise. Monitor all linked wallet addresses for unauthorized transactions and transfer remaining assets to a new, secure wallet if suspicious activity is detected. Report the incident to relevant blockchain security teams and consider filing a report with local cybercrime authorities. Future vigilance is advised, particularly when interacting with unsolicited token sales or presale offers.