grok48b[.]com

Analysis as of July 24, 2026 indicates that grok48b.com was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on August 4, 2025. The site presented the page title "GROK48B Official Website Presale (up to 200% bonus)", explicitly referencing a presale offering with an inflated bonus, and claims to be associated with Ethereum. The SSL certificate is identified as R10, and the domain resolves to IP 198.54.132.29, which is hosted in Canada under AS11878 (tzulo, inc.). Reputation services assign extremely low scores: Scamadviser 1/100 and Gridinsoft 0/100, confirming the malicious nature of the infrastructure.

The domain is listed on one security blocklist and has been blocked by PhishDestroy. VirusTotal reports that 2 of 95 scanning engines flagged the domain, reinforcing its classification as a crypto‑related scam. The current HTTP status is offline, indicating the site has been taken down or is otherwise unavailable. The available evidence confirms a brand‑impersonation campaign targeting Ethereum users, likely designed to lure victims with a promised 200 % presale bonus.

No additional technical artifacts such as malicious payloads, command‑and‑control endpoints, or phishing form URLs have been disclosed, leaving the full scope of the infrastructure uncertain. Defenders should continue to monitor DNS resolutions for the IP 198.54.132.29 and add grok48b.com to blocklists across email gateways, web proxies, and endpoint protection solutions. Organizations should also educate users about unsolicited Ethereum presale offers and advise verification against official sources. Ongoing threat‑intel feeds should be consulted for any re‑activation of the domain or related infrastructure.