grok-official[.]com

Analysis indicates that the domain grok-official.com is actively serving a credential phishing campaign as of July 12, 2026. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and currently resolves to the IP address 85.158.57.2, hosted on AS212238 (Datacamp Limited) in Poland. Infrastructure analysis reveals the use of Cloudflare nameservers (etta.ns.cloudflare.com and jermaine.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedown efforts. The SSL certificate is issued by Let's Encrypt (R13), providing HTTPS encryption to lend an appearance of legitimacy to the phishing page. The page title, 'Nuts&Gears,' does not correspond to a known brand or service, and no specific brand impersonation has been confirmed at this stage. The domain is flagged by one security blocklist (PhishDestroy) and has been assigned a trust score of 0/100 by Gridinsoft. VirusTotal reports that 3 out of 93 security vendors detect the domain as malicious, though this does not constitute exhaustive validation of its intent. The HTTP response code is 301, indicating a redirect, which may be used to funnel victims to a secondary phishing or malicious payload delivery site. Defenders should treat this domain as high-risk and prioritize blocking or monitoring traffic to 85.158.57.2 and associated subdomains. Given the use of Cloudflare and a recent registration date, additional domains under the same nameservers or registrar may warrant investigation for related malicious activity. No further details regarding the phishing kit, lure content, or targeted sectors are available at this time.