grokai-network[.]net

PhishDestroy identifies grokai-network.net as a confirmed generic phishing domain, currently offline but posing a significant threat during its active period. This site impersonated the GROK brand, specifically targeting users with a fake presale offering up to 200% bonuses, a common tactic to lure victims into connecting their wallets or providing sensitive information.

Technical analysis reveals that grokai-network.net was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026, and resolved to IP address 192.142.10.5. The domain used an SSL certificate from Let's Encrypt (R13) to appear legitimate. VirusTotal flagged it as malicious by 5 out of 95 security vendors, and it appeared on at least one security blocklist. Additionally, AlienVault OTX tracked the domain in 8 threat intelligence pulses, indicating widespread recognition of its malicious nature. The page title, "GROK Presale Up To 200% Bonuses," was a clear red flag promising unrealistic returns.

As of the latest check, grokai-network.net has been taken offline, but users who interacted with it should remain vigilant. PhishDestroy recommends that anyone who connected their wallet, entered credentials, or downloaded files from this domain immediately change their passwords, enable two-factor authentication, and monitor accounts for unauthorized activity. This incident underscores the importance of verifying domain authenticity and avoiding unsolicited presale offers. Always double-check URLs and rely on official channels for cryptocurrency transactions.