# greenx.today — SUSPICIOUS

> GreenX.today is a crypto drainer impersonating legitimate platforms. This domain (created 9/21/25) has 0/95 VirusTotal detections.

## Summary
PhishDestroy identifies greenx.today as an active crypto drainer phishing domain designed to trick users into surrendering cryptocurrency wallet credentials. This site mimics legitimate crypto platforms to steal funds, and it is already resolving to a suspicious IP address (104.21.69.87). The domain was registered only days ago (September 21, 2025), giving it minimal reputation and high potential for abuse among unsuspecting users. Its SSL certificate issued by Google Trust Services may misleadingly suggest legitimacy, but the combination of new registration, clean VirusTotal score (0/95 detections), and tie to a known phishing infrastructure operator demands immediate caution.

This domain was flagged using PhishDestroy’s automated pipeline after detecting patterns consistent with crypto drainer campaigns. It is registered via Spaceship, Inc., a registrar frequently used in high-volume malicious domain campaigns. The presence of 0 detections on VirusTotal is not uncommon for newly deployed phishing sites, as threat intelligence feeds take time to catch up. The IP (104.21.69.87) is part of Cloudflare’s network, which is often abused to host short-lived phishing pages that avoid easy takedown. The domain name “greenx.today” leverages a misspelling of “GreenX” (a known crypto exchange) combined with a .today TLD to appear timely and relevant to crypto investors.

If you visited greenx.today or entered any wallet credentials, wallet connect requests, private keys, or recovery phrases, your funds may be at immediate risk. Disconnect any connected wallets immediately using your wallet’s security settings. Revoke any suspicious token approvals via tools like revoke.cash or Etherscan. Do not interact with pop-ups or unsolicited prompts from this site. Report the domain and any transactions to PhishDestroy and your local cybercrime unit. Use hardware wallets and double-check URLs against official sources before entering credentials. Stay safe by verifying all crypto-related sites through PhishDestroy’s real-time threat database.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2025-09-21 03:47:29
- Registrar: Spaceship, Inc.
- IP: 104.21.69.87

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/bf921f40-fbb4-4854-ae3f-4d33bee7eb21
- PhishDestroy: https://phishdestroy.io/domain/greenx.today/
- LLM endpoint: https://phishdestroy.io/domain/greenx.today/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/greenx.today/
Last updated: 2026-03-22