grass-rewards[.]xyz

Analysis of the domain grass-rewards.xyz indicates it was actively involved in a fake airdrop phishing campaign, as classified by available threat intelligence. The domain was registered on March 20, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain utilized Cloudflare nameservers (dion.ns.cloudflare.com and mona.ns.cloudflare.com) and resolved to the IP address 172.67.218.138, which is geolocated to Canada and operated by Cloudflare, Inc. The use of Cloudflare services, including HSTS and HTTP/3, suggests an attempt to obscure hosting origins and enhance perceived legitimacy, though no SSL certificate was detected at the time of assessment. Detection metrics indicate elevated risk: Gridinsoft assigned a trust score of 0/100, and the domain appeared on one security blocklist, specifically PhishDestroy.

Six of 94 security vendors on VirusTotal flagged the domain as malicious, though the absence of broader detection does not preclude risk. The page title 'Just a moment...' is consistent with Cloudflare interstitial pages, which may have been used to filter or redirect traffic. The domain is currently offline, limiting further forensic analysis of its content or backend infrastructure. Defenders should treat this domain as part of a larger fake airdrop phishing operation targeting cryptocurrency users.

The combination of a recently registered domain, Cloudflare obfuscation, and minimal but confirmed detection warrants blocking at the DNS and network levels. Organizations are advised to monitor for related domains registered through the same registrar or resolving to the identified IP, as these may represent additional nodes in the campaign. No brand-specific indicators were present in the available data, so attribution to a particular cryptocurrency or project remains unconfirmed.