grass-tm[.]online

Analysis of grass-tm.online indicates active phishing infrastructure targeting users with a fraudulent internet rewards scheme. The domain was registered on July 11, 2026, through NAMECHEAP INC, two days prior to this investigation. It remains operational, resolving to IP address 172.67.141.138. The page title, 'Get rewarded for the internet you don't use,' suggests a lure designed to exploit users' interest in earning passive income or unused bandwidth compensation—a common tactic in tech support and fake reward scams. No detections were recorded by security vendors at the time of assessment, though this absence does not confirm legitimacy. The SSL certificate is issued by Google Trust Services, providing encrypted connections that may lower user suspicion. The domain's recent creation, combined with the specific reward-themed messaging, aligns with patterns observed in short-lived phishing campaigns. Defenders should treat this domain as malicious until further evidence emerges. Network-level blocking and monitoring of related infrastructure are recommended. The exact brand or service being impersonated is not yet confirmed, and no additional scam classification (e.g., crypto, investment) can be determined from available data.