grok82c[.]icu

The domain grok82c.icu was registered on May 09, 2026 via NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently hosted on Cloudflare infrastructure (nameservers morgan.ns.cloudflare.com, vita.ns.cloudflare.com) with the IP address 172.67.171.33 located in Canada. The site presents a page titled "GROK28G Official Pre-Sale — Get Up to 200% Bonus!" and is classified as a fake airdrop scam that impersonates the brand GROK, aligning with the supplied brand target of "grok". The SSL certificate is issued by Google Trust Services under the WE1 authority, indicating a valid TLS certificate despite the malicious intent. Threat intelligence sources record a single AlienVault OTX pulse referencing the domain, and it appears on one security blocklist; PhishDestroy has actively blocked the domain. Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal reports 2 of 92 security vendors flagging the domain as malicious, reinforcing its high‑risk status. The domain remains active, returning HTTP 200 responses, which suggests it is currently serving malicious content. Defenders should add grok82c.icu to URL filtering and DNS block lists, monitor for any outbound connections to the resolved IP, and consider isolating any internal traffic that attempts to resolve the domain. Continuous re‑scanning with multi‑engine services is advised to capture any evolving indicators, and security teams should remain aware that the site leverages a legitimate Cloudflare front end, which may obscure attribution in future investigations.