grass[.]io-stage2[.]app

Analysis of the domain grass.io-stage2.app indicates a high-risk phishing infrastructure currently active as of July 24, 2026. The domain is registered through NiceNIC International Group Co., Limited and resolves to 104.21.47.102, an IP address assigned to Cloudflare, Inc. (AS13335) in the United States. The site returns an HTTP 521 status, a code commonly associated with Cloudflare-protected pages that are either down or intentionally blocking direct access, often seen in phishing campaigns leveraging Cloudflare's services to evade detection. The page title 'Just a moment...' further suggests the use of Cloudflare's interstitial challenge or captcha system, a technique frequently exploited by threat actors to filter automated security scans and delay analysis.

Infrastructure analysis reveals the domain is using Cloudflare nameservers (garret.ns.cloudflare.com and kay.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1), which, while legitimate, is commonly abused in phishing operations due to its free availability and widespread trust. Technologies detected include hCaptcha, Cloudflare Browser Insights, and HTTP/3, all of which are consistent with modern phishing sites attempting to appear legitimate while hindering takedown efforts. The domain is flagged on two security blocklists, including PhishDestroy and ScamSniffer, and is assigned a Gridinsoft trust score of 0/100, indicating no established reputation and a high likelihood of malicious intent. While six of 93 security vendors on VirusTotal have flagged the domain, the exact nature of the phishing content remains unconfirmed due to the HTTP 521 status and Cloudflare protections.

No specific brand or scam type has been identified in the available data, and the page content has not been directly analyzed. Defenders should treat this domain as actively malicious and prioritize blocking it at the DNS, proxy, or firewall level.