grok555k[.]live

The domain grok555k.live masquerades as an official cryptocurrency presale site, offering up to a 200% bonus to lure victims. Despite its takedown, the domain was flagged as malicious by 14 out of 93 VirusTotal vendors, indicating its potential for widespread harm. The site was hosted on IP 188.114.97.3 under Cloudflare, Inc., with registration through NiceNIC International Group Co., Limited.

PhishDestroy identified grok555k.live on February 13, 2026, eight days before its official registration date, highlighting its proactive threat detection capabilities. The domain's lack of an SSL certificate further underscores its illegitimacy, as secure connections are a standard expectation for genuine sites. This early identification and subsequent takedown reflect effective collaboration between threat intelligence entities and hosting providers.

The domain's presence on a public blocklist, specifically PhishDestroy's, adds another layer of validation to its malicious intent. The operation likely aimed to exploit the cryptocurrency market's volatility and the allure of high returns. Although the site is now offline, its initial activity serves as a reminder of the persistent threat posed by phishing domains, especially those exploiting emerging financial technologies.