grasscores[.]xyz

The domain grasscores.xyz, associated with generic phishing activities, has been flagged by 4 out of 94 vendors on VirusTotal. Despite its takedown, the domain was first detected on the same day it was created, April 2, 2026. It is listed on three public blocklists, including PhishDestroy, MetaMask, and SEAL, indicating its malicious intent.

Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, grasscores.xyz was hosted on an IP address managed by CloudFlare, Inc., located in Canada. The absence of an SSL certificate suggests a lack of security measures, which is typical for phishing operations aiming to deceive users without raising security alerts. The platform risk score of 63 out of 100 reflects the potential threat level this domain posed before it was taken offline.

PhishDestroy's early detection of grasscores.xyz highlights the effectiveness of our threat intelligence pipeline, capturing malicious domains before they propagate widely across antivirus databases. The presence of this domain on multiple blocklists further underscores its phishing nature, serving as a reminder of the ongoing vigilance required to combat such threats. While the domain is currently offline, the rapid identification and response to its activities exemplify proactive measures in the cybersecurity landscape.