grok87k-fxempire[.]com

The domain grok87k-fxempire.com has been identified as a phishing site designed to deceive investors by impersonating Elon Musk’s purported AI-blockchain initiatives. Analysis indicates the site specifically promotes a fraudulent "GROK87K Presale," falsely claiming global investor interest to lure victims. The threat type is classified as a generic phishing scam with an elevated risk level, targeting individuals through social engineering tactics. Infrastructure analysis reveals the domain was registered through Ultahost, Inc. on May 30, 2026, an anomalous future date suggesting potential registrar manipulation or typosquatting. It resolves to the IP address 99.83.231.61 and employs technologies including Netlify, HSTS, Google Tag Manager, and Google Analytics, likely to mimic legitimate financial platforms. The domain appears on one security blocklist and is flagged by 1 of 95 security vendors on VirusTotal, while Gridinsoft assigns it a trust score of 0/100. The SSL certificate is issued by Let’s Encrypt, a common tactic to appear secure while conducting fraud. As of the latest assessment, grok87k-fxempire.com has been taken offline, though residual risks may persist. Organizations and individuals are advised to block the domain and associated IP (99.83.231.61) at the network level. Users should verify investment opportunities directly through official channels and report any encounters with this domain to relevant fraud prevention authorities. The anomalous registration date (2026) and single blocklist appearance warrant continued monitoring for related malicious activity.