greenw6[.]live

Greenw6.live is a credential phishing domain that was detected by PhishDestroy on February 18, 2026, before its official creation date of February 21, 2026. This early detection highlights the effectiveness of PhishDestroy's pipeline, which identifies threats in the critical window before they propagate through antivirus databases. At present, two out of 95 vendors on VirusTotal flag the domain as malicious, indicating that it is gaining recognition as a threat.

The domain is currently offline, but it was previously hosted on an IP address associated with Cloudflare, Inc., located in the United States. The registrar for this domain is NiceNIC International Group Co., Limited, and the SSL certificate was issued by Google Trust Services. The page title "Just a moment..." suggests it was designed to stall users while potentially harvesting credentials.

PhishDestroy has included greenw6.live in its public blocklist, further confirming its malicious nature. The fact that it has been taken down does not negate its potential impact, as phishing domains often reappear under different names or configurations. The early detection and subsequent takedown of this domain demonstrate the importance of proactive threat intelligence in combating credential phishing attacks.