grass-airdrop[.]pages[.]dev

This domain, grass-airdrop.pages.dev, is flagged as a high-risk brand impersonation campaign targeting users of airdrop schemes, specifically mimicking the Grass project. The domain was registered on March 29, 2026, through Cloudflare, Inc., and resolves to IP 188.114.97.3, located in Canada and belonging to Cloudflare. It uses Cloudflare nameservers desi.ns.cloudflare.com and norman.ns.cloudflare.com, and its SSL certificate is issued by Google Trust Services. The page title is Grass: Earn A Stake in the AI Revolution, and the domain remains active as of July 12, 2026, with an HTTP 200 status code. Analysis of the domain infrastructure reveals use of technologies including jsDelivr, HSTS, crypto-js, cdnjs, and HTTP/3, which are common in phishing kits designed to appear legitimate. The domain appears on five security blocklists and is blocked by services including PhishDestroy, MetaMask, ScamSniffer, SEAL, and Enkrypt. VirusTotal reports that 5 out of 95 security vendors flag this domain as malicious, indicating moderate but not universal detection across the security community. Scamadviser assigns a trust score of 11/100, and Gridinsoft gives a score of 0/100, both confirming high risk. The domain impersonates a legitimate airdrop project to deceive users into connecting wallets or providing credentials, likely leading to asset theft. What remains uncertain is the full scope of the campaign, including whether the domain is part of a larger network of phishing sites or if it targets specific geographic regions. Defenders should immediately block access to grass-airdrop.pages.dev at network and endpoint levels, add it to blocklists, and monitor for similar domains using the same IP range or Cloudflare infrastructure. Users who have interacted with this site should be warned to revoke any wallet permissions and change credentials. The domain creation date in March 2026 and active status suggest sustained operation, requiring ongoing vigilance.