getgrass[.]cc

This domain is flagged as a crypto credential harvesting site designed to impersonate legitimate cryptocurrency platforms. Analysis indicates its primary objective is the unauthorized extraction of wallet credentials, private keys, and seed phrases through deceptive login interfaces. The infrastructure mimics trusted services to exploit user trust, often redirecting victims to fake dashboards or prompting them to enter sensitive information under false pretenses. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain getgrass.cc resolves to the IP address 172.67.192.231, hosted behind Cloudflare’s network, and is associated with a Let’s Encrypt SSL certificate, providing a false sense of security. It appears on 5 independent security blocklists and is flagged by 5 out of 95 security vendors on VirusTotal. The domain was registered on May 28, 2026, through Global Domain Group LLC, an entity frequently linked to high-risk registrations. The page title, 'Just a moment...,' is characteristic of Cloudflare interstitial pages used to mask malicious content before redirecting users to phishing interfaces. Users who have visited getgrass.cc or entered credentials on the site should take immediate action to mitigate risk. All exposed wallet credentials, including private keys and seed phrases, must be considered compromised. Affected users are advised to transfer assets to a new, secure wallet using a clean device and to revoke any connected dApp authorizations. Monitor transaction histories for unauthorized activity and report the incident to relevant security response teams. Given the domain’s elevated risk level and offline status, continued vigilance is required, as threat actors may re-deploy the infrastructure under a different domain or IP address.