grassfoundations[.]netlify[.]app

This domain, grassfoundations.netlify.app, was identified as a crypto wallet drainer phishing operation targeting users of decentralized finance platforms. The site likely employed social engineering tactics, such as fake wallet connection prompts or fraudulent token airdrop claims, to trick victims into authorizing malicious transactions. Once connected, the drainer would siphon cryptocurrency assets from the victim's wallet by exploiting smart contract vulnerabilities or unauthorized transaction approvals. Analysis indicates the domain was registered on February 21, 2026, through Name.com, Inc., and resolved to the IP address 35.157.26.135. It was flagged by 1 out of 95 security vendors on VirusTotal and appeared on three independent security blocklists. The infrastructure was hosted on Netlify, with an SSL certificate issued by DigiCert Inc, and employed HTTP Strict Transport Security (HSTS) to lend an appearance of legitimacy. Despite its current offline status, the domain remains a documented threat due to its prior malicious activity. Users who visited grassfoundations.netlify.app or interacted with its content should immediately revoke any connected wallet permissions using a blockchain explorer or wallet management tool. Monitor transaction histories for unauthorized transfers and consider transferring remaining assets to a new wallet. Report the incident to relevant security teams or threat intelligence platforms to aid in tracking and mitigating further risks associated with this campaign.