grok46k-fxempire[.]com

PhishDestroy identifies grok46k-fxempire.com as an active fake investment scam domain currently under investigation for phishing activities. Despite zero detections on VirusTotal (0/95), the domain exhibits multiple red flags including a recent creation date (May 10, 2026), association with Ultahost, Inc., and resolution to IP address 75.2.60.5. The presence of a Let's Encrypt SSL certificate further obscures malicious intent by providing a false sense of legitimacy. As of now, this domain remains unblocked by major threat intelligence feeds, posing an elevated risk to users engaging with financial or investment-related content. This domain was flagged by PhishDestroy with the following indicators: VirusTotal shows 0/95 detections, domain creation occurred on May 10, 2026, and it resolves to IP 75.2.60.5. The registrar is Ultahost, Inc., and the SSL certificate is issued by Let's Encrypt. No confirmed blocklist entries or trust score metrics are currently available, indicating a newly emerged but rapidly evolving threat vector. The absence of detections suggests this scam is in its early stages, leveraging fresh infrastructure to evade detection systems. To mitigate risks associated with grok46k-fxempire.com, users should avoid clicking any links or interacting with the domain. Security teams are advised to block the IP address 75.2.60.5 and monitor for associated network traffic. Reporting the domain to threat intelligence platforms and updating browser-based blocklists will help prevent further propagation. Organizations should also conduct user awareness training to recognize fake investment scams, as these often mimic legitimate financial platforms to harvest credentials or install malware.