grok46k[.]org

This domain, grok46k.org, is flagged as an active generic phishing site targeting users with a fraudulent presale offer. Analysis indicates the domain was registered on May 15, 2026, through Ultahost, Inc., and currently resolves to the IP address 75.2.60.5. The page title, 'GROK46K Presale - Official Website - Early Access Bonus up to 200%', explicitly advertises a high-reward incentive, a common tactic used to lure victims into disclosing sensitive information or transferring funds under false pretenses. Infrastructure analysis reveals the use of WordPress, MySQL, PHP, and jQuery, alongside third-party services such as Tidio and Netlify, which are frequently leveraged in both legitimate and malicious websites. The presence of HSTS suggests an attempt to appear secure, though the SSL certificate is issued by Let's Encrypt, a free and widely used certificate authority that does not inherently validate the legitimacy of the domain. The domain has been detected in 16 threat intelligence pulses on AlienVault OTX and is listed on two security blocklists, including PhishDestroy and BLP-Malware. Six out of 95 security vendors on VirusTotal have flagged the domain as malicious, reinforcing its classification as high-risk. The exact nature of the scam remains uncertain due to the lack of detailed content analysis, but the page title and infrastructure suggest a focus on financial deception, possibly involving cryptocurrency or investment fraud. The domain's recent registration date and active status indicate it is part of an ongoing campaign. Defenders should treat this domain as hostile and implement blocking measures at the network and endpoint levels. Monitoring for related domains or IP associations may help identify broader infrastructure used in this campaign. Given the domain's presence on multiple threat intelligence platforms, organizations are advised to review logs for any interactions with grok46k.org and investigate potential compromises.