grasstokendrop[.]pages[.]dev

Analysis of the domain grasstokendrop.pages.dev indicates active phishing infrastructure targeting cryptocurrency users through a fraudulent airdrop scheme. The domain, registered on November 5, 2024, via Cloudflare Pages, currently resolves to IP 188.114.96.3 (Cloudflare, Inc., Canada) and returns an HTTP 200 status. The page title explicitly claims affiliation with a 'Grass Token Airdrop Official Website' and promotes a token pre-sale with bonuses up to 200%, aligning with known airdrop scam tactics. SSL certification is provided by Google Trust Services (WE1), a common feature in both legitimate and malicious sites leveraging Cloudflare's infrastructure. Technical indicators include detection by three security vendors on VirusTotal and presence on one security blocklist (PhishDestroy). The domain employs standard web technologies (Bootstrap, Google Tag Manager, HTTP/3) and tracking tools (Statcounter), which are not inherently malicious but are frequently used in phishing campaigns to monitor victim interactions. Gridinsoft assigns a trust score of 0/100, reinforcing its classification as high-risk. While the exact content of the site remains unanalyzed, the combination of airdrop-themed branding, pre-sale incentives, and impersonation of a cryptocurrency token (Grass Token) suggests an intent to harvest credentials, private keys, or direct cryptocurrency transfers. Defenders should treat this domain as active phishing infrastructure and prioritize blocking at DNS, proxy, or endpoint levels. Further investigation may reveal associated wallet addresses or additional domains using similar naming conventions (e.g., 'grass token' variants). No evidence currently links this domain to a legitimate Grass Token project.