grok54h-cointelegraph[.]com

This domain, grok54h-cointelegraph.com, is flagged as a high-risk generic phishing site designed to deceive cryptocurrency users. Analysis indicates the domain impersonates a legitimate token presale for GROK54H, falsely claiming endorsement by Elon Musk to lure victims into transferring funds. The page title, 'Elon Musk Officially Launches GROK54H Presale,' directly exploits brand recognition to manipulate targets, a common tactic in crypto-drainer phishing campaigns. No legitimate association with the purported brand or individual has been verified. Infrastructure analysis reveals the domain was registered on May 1, 2026, through Ultahost, Inc., and resolves to the IP address 75.2.60.5. It is detected by 11 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The domain appears on three security blocklists and is actively blocked by multiple threat intelligence feeds, including MetaMask and PhishDestroy. Detected technologies include WordPress, MySQL, PHP, Vue.js, Netlify, jQuery, HSTS, and Google Tag Manager, suggesting a sophisticated frontend designed to mimic legitimate crypto project websites. As of the latest assessment, grok54h-cointelegraph.com has been taken offline, reducing immediate exposure. However, residual risk persists due to potential re-registration or migration of the phishing infrastructure to new domains. Users who interacted with the domain are advised to revoke any connected wallet permissions, monitor for unauthorized transactions, and verify the legitimacy of any crypto-related communications. Security teams should update blocklists and monitor for similar domains leveraging the same IP or registrar patterns.