gro88k[.]org

Analysis as of July 24 2026 shows that the domain gro88k.org was created on March 03 2026 via NiceNIC International Group Co., Limited and is currently offline. The site hosted a token‑presale landing page titled “GRO88K Presale – Official Website – Early Access Bonus up to 200%”, explicitly impersonating the Ethereum brand. Infrastructure inspection reveals that the domain resolves to the IPv4 address 85.158.57.2, which is announced by AS212238 (Datacamp Limited) and geolocated to Poland.

Both authoritative name servers are Cloudflare (marvin.ns.cloudflare.com, serena.ns.cloudflare.com), indicating use of a third‑party CDN for rapid deployment. No TLS certificate is presented, meaning traffic is served over plain HTTP, which further reduces trust signals for visitors. The domain appears on a single security blocklist and has been listed by PhishDestroy; VirusTotal records show that 2 of 94 scanning engines flagged the domain, providing independent corroboration of malicious intent.

The phishing kit identified is a “Token Presale” package, a known template used to lure cryptocurrency investors with fabricated bonus offers. Because the site is already taken offline, immediate remediation focuses on preventing re‑use of the same infrastructure: defenders should add gro88k.org and its resolving IP 85.158.57.2 to network‑level deny lists, monitor for new domains registered by the same registrar or ASN, and enforce heuristic detection of token‑presale content that mentions “Early Access Bonus” or similar phrasing. Continuous observation of Cloudflare‑hosted domains associated with the same nameservers can help catch rapid redeployments, and security teams should share the indicator set with threat‑sharing platforms to improve collective visibility.