grok65b[.]sale

Analysis of the domain grok65b.sale indicates it was registered on February 21, 2026 and subsequently hosted on Cloudflare infrastructure (ASN13335) with the IP address 104.21.93.154 located in the United States. The domain is delegated to the Cloudflare nameservers jakub.ns.cloudflare.com and kinsley.ns.cloudflare.com. No TLS certificate was observed, and the site currently returns an offline HTTP status, suggesting the phishing page has been taken down or is temporarily unavailable. The page title captured before takedown reads "GROK65B Official Pre‑Sale — Get Up to 200% Bonus!", implying a lure that promises a large bonus to entice victims, a pattern common to generic phishing campaigns.

Threat intelligence feeds have flagged the domain: PhishDestroy lists it as blocked, and it appears on one external security blocklist. VirusTotal scans show that 11 of 93 scanning engines flagged the domain as malicious, reinforcing the suspicion of a phishing operation. No additional data such as Safe Browsing verdicts, Open Threat Exchange entries, or brand‑specific targeting were supplied, leaving the exact content of the phishing page unknown.

Defenders should proactively block the domain and its resolving IP at network perimeter devices, add the domain to local URL filtering lists, and monitor for new registrations using the same Cloudflare nameservers or similar naming patterns. Continuous DNS monitoring is advised to detect any re‑activation of the domain, and TLS inspection policies should be enforced to flag the absence of a valid certificate. Organizations should also update endpoint protection signatures to include the observed VirusTotal detections, reducing the risk of client‑side compromise should the site become active again.