grok65glaunch[.]com

Analysis of grok65glaunch.com shows a newly registered domain (creation date 21 February 2026) hosted on a Polish IP address (85.158.57.2) belonging to AS212238 Datacamp Limited. The domain resolves through Cloudflare nameservers (carlos.ns.cloudflare.com, zita.ns.cloudflare.com) and presents a valid TLS certificate issued by Let’s Encrypt (R13). An HTTP 301 response redirects visitors to a landing page whose title is reported as "Nuts&Gears"; the actual content of the page has not been captured, so the specific phishing payload remains unknown. The registration was processed by NiceNIC International Group Co., Limited. Independent scanning on VirusTotal recorded detections by 2 of 93 security vendors, and Gridinsoft assigned a trust score of 0/100, indicating a high likelihood of malicious intent. The domain is currently listed on at least one public blocklist and has been flagged by the PhishDestroy sinkhole. Given the high risk rating and active status, defenders should block the domain and its associated IP at perimeter devices, add the IP to internal reputation feeds, and monitor for any outbound connections to the host. Continuous observation of DNS queries for grok65glaunch.com and related Cloudflare name servers is advised to detect potential re‑use of the infrastructure in future campaigns.