grasslayers[.]xyz

This domain is flagged as an elevated-risk brand impersonation threat targeting MetaMask, a widely used cryptocurrency wallet service. Analysis indicates the infrastructure was specifically designed to deceive users into believing they were interacting with the legitimate MetaMask platform, likely for the purpose of crypto asset theft or credential harvesting. The domain exhibits characteristics consistent with crypto drainer schemes, where victims are tricked into connecting wallets to malicious smart contracts, resulting in unauthorized fund transfers. Infrastructure analysis reveals grasslayers.xyz was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 13, 2026, and resolved to the IP address 104.21.83.153. The domain is currently offline but was previously detected by 6 out of 95 security vendors on VirusTotal, appearing on three distinct security blocklists. It has been explicitly blocked by multiple cryptocurrency security platforms, including MetaMask’s own threat intelligence systems. The creation date, while anomalous (future-dated), may indicate an attempt to evade temporal-based detection mechanisms or reflect a data entry error during registration. Mitigation steps for this specific threat type include immediate domain blacklisting across all network security layers, particularly in web filtering and DNS resolution systems. Organizations and individuals should verify wallet connection prompts against official MetaMask domains and enable transaction simulation tools to detect unauthorized smart contract interactions. End-users are advised to revoke any prior wallet connections to grasslayers.xyz via official MetaMask settings and monitor wallet activity for anomalous transactions. Given the domain’s association with crypto drainer infrastructure, affected parties should assume potential compromise of wallet permissions and consider migrating assets to new wallet addresses.