grok79t[.]com

The domain grok79t.com was registered on April 21, 2026 through Internet Domain Service BS Corp and is currently marked as active with a high risk rating. The site returns HTTP 200 and presents the title “GROK79T Official Website Presale (up to 200% bonus)”, indicating a presale investment lure.

Infrastructure analysis shows the domain resolves to 99.83.231.61, an address located in the United States and served via AWS Global Accelerator. The site uses a Let’s Encrypt certificate (E8) and relies on Cloudflare nameservers nena.ns.cloudflare.com and theo.ns.cloudflare.com, a typical pattern for fast‑flux or evasive hosting.

Threat intelligence sources corroborate the malicious nature. AlienVault OTX lists the domain in one pulse, Gridinsoft assigns a trust score of 0 out of 100, and it appears on a single security blocklist. PhishDestroy actively blocks the domain, and VirusTotal reports one of ninety‑five scanners flagging it as malicious.

Observations remain limited; only a single detection pulse and a single vendor flag are available, leaving the full scope of the campaign uncertain. The page’s marketing language suggests a phishing campaign aimed at users seeking high‑return presale offers, but the specific victim demographics and any credential‑harvesting mechanisms have not been disclosed.

Defenders should add grok79t.com to DNS and URL filtering policies, enforce TLS inspection to capture the underlying HTTP content, and monitor for any additional domains that resolve to the same IP address or share the Cloudflare nameservers. Continuous re‑evaluation is advised as further indicators may emerge.