grokiusdrop[.]live

Analysis of the domain grokiusdrop.live, observed on July 25 2026, indicates it is part of a cryptocurrency airdrop phishing campaign. The domain was registered on 27 February 2026 through NiceNIC International Group Co., Limited and resolves to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geo‑located in the United States. No TLS certificate is presented, meaning the site is reachable only over HTTP, a characteristic often found in low‑cost phishing kits. The publicly visible page title "Grokius Maximus Airdrop" aligns with the known "Airdrop Scam" phishing kit, further supporting the attribution to a crypto‑airdrop lure.

Four independent security blocklists—PhishDestroy, MetaMask, ScamSniffer, and SEAL—have already listed the domain, and the site is currently taken offline. VirusTotal scans show that three of ninety‑three security vendors flagged the domain, providing additional corroboration of malicious intent. The domain uses the Cloudflare nameservers anirban.ns.cloudflare.com and marjory.ns.cloudflare.com, a configuration frequently employed by rapidly provisioned malicious sites.

Because the site is offline, live content cannot be examined, and no additional artifacts such as malicious payloads or credential‑harvesting forms have been captured. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑registration attempts, and consider adding the IP address to threat‑intel feeds. Organizations that handle cryptocurrency assets should educate users about unsolicited airdrop offers, enforce strict URL verification, and apply web‑filtering rules to prevent access to known malicious crypto‑related domains.