greenhouse[.]com[.]uy

On August 02, 2026, the domain greenhouse.com.uy was observed actively hosting a phishing infrastructure. The domain resolves to the IPv4 address 200.40.79.219 and is delegated to four Montevideo‑based name servers (ns1‑ns4.montevideo.com.uy). Google Safe Browsing classifies the site under the “social engineering” category, indicating that the content is designed to deceive users into divulging credentials or personal data. VirusTotal analysis shows that four of ninety‑one scanning engines have flagged the domain as malicious, reinforcing the suspicion of malicious intent.

The domain is listed on at least one public phishing blocklist and is actively blocked by the PhishDestroy service, confirming that security communities have taken mitigation steps. Infrastructure analysis reveals no publicly disclosed SSL certificate details; the HTTPS handshake has not been captured, and the HTTP response status code is unknown. The registrar information and registration dates are not provided in the current intelligence set, limiting attribution efforts. No page title or brand reference has been extracted, so the specific entity being impersonated cannot be confirmed at this time.

Nevertheless, the combination of a dedicated IP, authoritative name servers, and multiple independent detections demonstrates a high‑confidence malicious phishing operation. Defenders encountering traffic to greenhouse.com.uy should block the domain at network perimeters, update URL filtering policies, and monitor for credential‑theft patterns that may originate from this host. Incident response teams are advised to collect DNS query logs, TLS handshake data, and any client‑side artifacts for further forensic correlation. Continuous monitoring of threat‑intel feeds for additional indicators, such as hash values or payload samples linked to the four VirusTotal detections, is recommended to enhance detection coverage.