grok35k[.]com

The domain grok35k.com was registered on March 11, 2026 through NiceNIC International Group Co., Limited and is currently hosted on an IP address 192.142.10.5 located in the Netherlands under ASN 214036 (Ultahost, Inc.). The authoritative nameservers clyde.ns.cloudflare.com and miki.ns.cloudflare.com indicate that the domain is fronted by a cloud service provider. An active TLS certificate issued by Let’s Encrypt (R12) secures the site, and HTTP requests return a 200 status code. The site presents a page titled “GROK35K Official Website Presale (up to 200% bonus)” and mimics the Ethereum brand to lure victims into a token presale scheme. Static analysis of the page reveals the use of WordPress, MySQL, PHP, LiteSpeed, jQuery, and HTTP/3, a technology stack commonly associated with the publicly available Token Presale phishing kit. The content explicitly advertises a cryptocurrency investment opportunity, matching the classification of a brand‑impersonation scam targeting Ethereum users. Observational data shows the domain appears on a single security blocklist and is listed as blocked by PhishDestroy. VirusTotal scans have resulted in 7 of 95 security vendors flagging the domain as malicious, while the Gridinsoft trust score is 0 out of 100. The combination of a newly created domain, low trust scores, and the presence of a known phishing kit elevates the risk assessment to high, and the domain remains active as of the report date. Defenders should add grok35k.com to domain blocklists, monitor DNS queries for the associated IP address, and enforce TLS inspection to capture malicious payloads delivered through the WordPress site. Email gateways should be configured to detect and quarantine messages referencing the “200% bonus” presale phrasing or the Ethereum brand. Continuous threat‑intel feeds should be checked for any additional indicators tied to the underlying hosting infrastructure.