grok37k[.]icu

This domain, grok37k.icu, is identified as a brand impersonation threat specifically targeting Google. Analysis confirms it operates as a fraudulent login portal designed to harvest user credentials through deceptive page replication. The domain is currently offline but was actively impersonating Google’s official interface, including identical page titles and visual elements. Infrastructure analysis reveals critical indicators: the domain was flagged by 7 of 95 security vendors on VirusTotal, resolving to the IP address 142.251.153.119. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on June 02, 2026, it appears on one security blocklist. Technical artifacts include the use of particles.js, Google Web Server, and a Let’s Encrypt SSL certificate, alongside HTTP/3 and HSTS protocols. The creation date discrepancy and Cloudflare Browser Insights integration further suggest malicious intent. While currently offline, the domain’s infrastructure and historical activity warrant caution. Users are advised to verify domain authenticity before entering credentials, particularly on pages mimicking Google. Organizations should monitor for similar impersonation attempts, block the domain at network level, and review logs for connections to 142.251.153.119. Proactive measures include updating blocklists and educating users on recognizing brand impersonation tactics.