grok66k[.]pro

grok66k.pro was observed hosting a page titled “GROK66K Official Pre‑Sale — Get Up to 200% Bonus!”. The site was taken offline before this analysis, but historical data indicate it was actively serving content that promoted a pre‑sale offering with an inflated bonus, a pattern commonly associated with phishing campaigns that lure victims with unrealistic financial incentives. The domain resolves to 188.114.96.3, an IP address owned by AS13335 Cloudflare, Inc., located in the United States. Cloudflare’s reverse DNS and the presence of the nameservers jade.ns.cloudflare.com and nero.ns.cloudflare.com confirm that the domain leveraged Cloudflare’s CDN and HTTP/3 capabilities. The TLS certificate was issued by Google Trust Services under the WE1 brand, providing a legitimate‑looking HTTPS connection that can increase user trust.

Reputation checks are uniformly negative. The Gridinsoft trust score is 0 out of 100, and the domain appears on one security blocklist. PhishDestroy has already blocked the domain, and VirusTotal reports that 13 of 93 scanning engines flagged the site, indicating a moderate level of consensus among security vendors. The registrar listed is NiceNIC International Group Co., Limited, a provider that has been associated with rapid registration of abusive domains in the past.

Given the offline status, direct investigation of the live payload is not possible, and the exact content of the page beyond the title remains unknown. The limited number of vendor detections and the single blocklist entry suggest that the host may have been in an early stage of deployment or that detection signatures have not yet fully converged. Defenders should continue to block the IP address 188.114.96.3 and the associated Cloudflare nameservers, ensure that outbound traffic to the domain is denied, and monitor for any new domains that resolve to the same IP range.