gro11k[.]net

The domain gro11k.net was observed as part of a brand impersonation campaign targeting Ethereum. The site presented the page title “GRO11K Token – Official Presale Website - Up to 200% Early Participation Bonus,” indicating a token presale lure. Registration data shows the domain was created on 26 February 2026 and is registered with NameSilo, LLC. DNS resolution points to the IPv4 address 192.142.10.5, which is announced by AS214036 (Ultahost, Inc.) and geolocated to the Netherlands. The domain uses Cloudflare authoritative nameservers (linda.ns.cloudflare.com, mario.ns.cloudflare.com) but does not present an SSL/TLS certificate, leaving the connection unencrypted. VirusTotal analysis recorded 2 detections out of 95 scanned security vendors, confirming malicious classification by multiple engines.

The domain is listed on a single security blocklist and has been blocked by the PhishDestroy service. The underlying phishing kit is identified as “Token Presale,” a known template used to solicit cryptocurrency investments. Current operational status is reported as offline, suggesting the site has been taken down or is no longer serving content. Evidence gaps remain regarding the full content of the landing page, any credential capture mechanisms, and the presence of additional infrastructure such as supporting sub‑domains or command‑and‑control hosts.

No SSL certificate or HTTPS enforcement limits the ability to assess certificate transparency logs. No public safe‑browsing verdicts or Open Threat Exchange (OTX) references are available in the provided data. Defenders should add the domain and its associated IP address to local and network‑level blocklists, monitor for any future resolution to the same IP range, and enforce strict outbound filtering for traffic to newly registered domains lacking TLS. Threat‑intel feeds should be updated with the registrar, nameserver, and kit information to improve detection of similar token‑presale impersonation attempts.