grok59k-cryptoslate[.]com

The domain grok59k-cryptoslate.com is identified as a cryptocurrency wallet phishing site designed to steal user credentials and private keys. Analysis confirms the domain is currently offline, though it previously posed a direct threat to users of decentralized finance (DeFi) platforms by impersonating legitimate crypto services to facilitate fraudulent transactions and unauthorized access to digital assets. Infrastructure analysis reveals the domain was flagged by 6 of 95 security vendors on VirusTotal, indicating moderate detection coverage. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026, the domain resolved to the IP address 188.114.97.3. It appears on three security blocklists, and threat intelligence platforms such as AlienVault OTX recorded its presence in at least one threat pulse. The domain’s Gridinsoft trust score is 0/100, further confirming its malicious nature. Additional technical indicators include its inclusion in blocklists maintained by cryptocurrency security entities and its association with known phishing campaigns targeting wallet extensions. Current status indicates the domain has been taken offline, reducing immediate risk to users. However, the infrastructure may remain active or resurface under a different domain. Organizations and individuals are advised to block the domain and its associated IP (188.114.97.3) at the network level. Users should verify the authenticity of any crypto-related website by cross-referencing official sources and checking for SSL certificates issued to the legitimate entity. Security teams are recommended to monitor for similar domains registered through the same registrar and to update endpoint protection rules to detect and prevent access to known phishing infrastructure.