grok47m[.]icu

This domain, grok47m.icu, is identified as a cryptocurrency pre-sale phishing site designed to deceive users into participating in fraudulent token sales. The page title, 'GROK47M Official Pre-Sale — Get Up to 200% Bonus!', explicitly targets individuals seeking early investment opportunities in digital assets, leveraging urgency and high-return promises to extract sensitive information or direct cryptocurrency payments. Such schemes are commonly associated with advance-fee fraud, where victims are lured into sending funds under false pretenses of guaranteed returns or exclusive access to unregulated token offerings. The use of fabricated bonus incentives (e.g., '200% Bonus') is a hallmark of social engineering tactics employed to override user skepticism and accelerate financial transactions without due diligence. Analysis of the domain's infrastructure reveals multiple indicators of malicious intent. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.), a network commonly utilized to obfuscate the true origin of phishing infrastructure. Security vendors have flagged this domain in 17 out of 95 detection engines on VirusTotal, while it appears on at least one security blocklist. The absence of an SSL certificate further undermines the domain's legitimacy, as modern browsers and security tools flag such sites as insecure. Additionally, the domain has been taken offline, suggesting either remediation efforts or a shift to alternative infrastructure to evade detection. Users who visited grok47m.icu or interacted with its content should take immediate corrective actions to mitigate potential risks. First, any cryptocurrency transactions initiated through this domain should be considered compromised, and victims are advised to report the incident to relevant financial authorities or blockchain analysis platforms to trace or freeze stolen assets. Second, users should revoke any wallet permissions or API access granted to the site and monitor connected accounts for unauthorized transactions. Third, devices used to access the domain should undergo a thorough security scan to detect and remove any malware or persistent threats. Finally, affected individuals should remain vigilant for follow-up phishing attempts, as attackers may reuse collected data to target victims through alternative channels, such as email or social media.