grokox[.]com

Analysis of grokox.com indicates an active brand impersonation campaign targeting the foundation brand. The domain was registered on April 06, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and is secured with a GoDaddy.com TLS certificate issued by the GoDaddy TLS Intermediate CA DV - R1v1. The site resolves to IP address 69.5.189.55, which belongs to AS42624 Global-Data System IT Corporation and is geolocated in Switzerland. Nameserver delegation points to ns1.nameserverhub.com, ns2.nameserverhub.com, ns3.nameserverhub.com, and ns4.nameserverhub.com. The HTTP response returns status code 200 and the page title "GROKOX | Play at the best online casino based on Blockchain". The content is identified as employing the Gambler Scam phishing kit, consistent with a cryptocurrency‑focused fraud vector. The domain appears on one security blocklist, has a Gridinsoft trust score of 0 out of 100, and is listed as blocked by PhishDestroy. VirusTotal scans show two of ninety‑five security vendors flagging the domain, indicating limited detection but not confirming safety. The risk rating is high and the campaign remains active. Defenders should prioritize blocking the domain and its associated IP address at perimeter and DNS layers, incorporate the observed TLS certificate fingerprint into threat intel feeds, and monitor for any additional infrastructure sharing the same nameservers or ASN. Continuous observation of related certificate issuances and newly observed Gambler Scam kit deployments is recommended to pre‑empt further impersonation attempts.