get[.]grass[.]lc

get.grass.lc is currently classified as a high‑risk generic phishing site. The domain is hosted behind Cloudflare (registered through Cloudflare, Inc.) and resolves to the IPv4 address 172.67.152.175, which is owned by AS13335 Cloudflare, Inc. in the United States. The TLS certificate is issued by Google Trust Services under the WE1 identifier, and the site serves HTTP/3 traffic. An HTTP 521 response indicates that the origin server is unavailable, a pattern commonly observed in malicious hosting that relies on Cloudflare’s edge network. The page title returned by the server is “Grass - Link in Bio | LINK3”, suggesting the site presents a link‑in‑bio service, but no further content analysis is available. VirusTotal has recorded 2 detections out of 95 scanned engines, and the domain appears on one external blocklist. PhishDestroy has already blocked the domain. The domain remains active as of 13 July 2026. Analysts should continue to monitor the address, block the domain at perimeter defenses, and consider adding the associated IP to deny‑list rules. Since the underlying payload or credential‑capture page has not been observed, additional investigation is required to determine the exact phishing vector and any victim data exposure.