grok66k[.]icu

This domain, grok66k.icu, is identified as a cryptocurrency presale phishing site targeting users with fraudulent bonus offers. Analysis of the page title, 'GROK66K Official Website Presale Get Up to 200% Bonus!', indicates an attempt to impersonate a legitimate token presale or investment opportunity. The domain appears to be part of a broader campaign leveraging high-return promises to deceive victims into transferring cryptocurrency or disclosing wallet credentials. No legitimate financial service or blockchain project is associated with this domain, and the use of fabricated urgency ('200% Bonus') aligns with known social engineering tactics employed in cryptocurrency drainer schemes. Technical indicators confirm the malicious nature of grok66k.icu. The domain was registered on November 17, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.213.185, hosted on AS13335 (Cloudflare, Inc.), a network commonly used to mask the true origin of phishing infrastructure. VirusTotal detections report 14 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist and is actively blocked by PhishDestroy. Notably, the domain lacks an SSL certificate, a red flag for any site handling financial transactions or user credentials. Google Safe Browsing does not currently list the domain, suggesting it may have evaded detection during its active phase or was taken down before widespread reporting. As of the latest verification, grok66k.icu has been taken offline, reducing immediate exposure to users. However, the infrastructure remains a residual risk, as threat actors may repurpose the domain or associated assets for future campaigns. Organizations and individuals are advised to block the domain and its resolving IP (172.67.213.185) at the network level, and monitor for any re-emergence of similar domains using the 'grok66k' branding or comparable presale lures. Users who interacted with the site should assume credential or wallet compromise and take immediate remedial actions, including revoking access to connected applications and transferring assets to a new wallet. The elevated risk level is retained due to the domain's recent activity and the persistent threat posed by cryptocurrency phishing schemes.