grok83g[.]icu

This domain, grok83g.icu, operates as a crypto investment scam designed to deceive users into participating in a fraudulent token pre-sale. The site advertises a "200% bonus" incentive to lure victims into transferring cryptocurrency, likely to wallet addresses controlled by threat actors. Analysis of the page title and promotional claims indicates an attempt to exploit interest in emerging crypto projects, a common tactic in cryptocurrency drainer schemes where funds are irreversibly siphoned once sent. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, with an unusually forward-dated creation timestamp suggesting potential obfuscation. It resolves to IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335), and currently lacks an SSL certificate. Security vendors on VirusTotal flagged the domain at a 14/95 detection rate, while it appears on one confirmed security blocklist. The domain has since been taken offline, though historical DNS records confirm its prior operation. Users who visited grok83g.icu or engaged with its content should assume potential exposure to financial fraud. Immediate actions include revoking any connected wallet permissions, monitoring transaction histories for unauthorized transfers, and reporting the incident to relevant cryptocurrency abuse platforms. If cryptocurrency was transferred, victims should document all transaction hashes and contact their wallet provider or exchange for potential recovery assistance. No further interaction with the domain or associated communications should occur.