groksharkcoin[.]icu

This domain, groksharkcoin.icu, is flagged as an active cryptocurrency phishing operation targeting users since its registration on April 4, 2026. Analysis indicates the infrastructure is hosted behind Cloudflare, resolving to 188.114.97.3 in Canada, with nameservers june.ns.cloudflare.com and nikon.ns.cloudflare.com. The domain remains operational despite returning an HTTP 403 status, suggesting access controls may be in place to evade automated detection or restrict traffic to specific regions or user agents. A Let's Encrypt SSL certificate (YE1) is present, providing a superficial layer of legitimacy to unsuspecting visitors. Threat intelligence confirms the domain appears in 22 pulses on AlienVault OTX and is listed on at least one security blocklist, reinforcing its classification as malicious. While four out of ninety-five security vendors on VirusTotal flag the domain, the low detection rate does not indicate safety but rather highlights the limitations of signature-based detection against evolving phishing tactics. The registration via NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains, further supports the assessment of malicious intent. Defenders should prioritize blocking this domain at the DNS and network layers, given its persistence and active status. The use of Cloudflare complicates traditional IP-based blocking, necessitating reliance on domain reputation and behavioral analysis. Monitoring for related certificates issued by Let's Encrypt under the same registration details or similar naming conventions may uncover additional phishing infrastructure. Given the domain's focus on cryptocurrency, organizations handling digital asset transactions should treat this domain as high-risk and investigate any historical or ongoing connections from internal networks.