greenprox[.]cc

This domain, greenprox.cc, is identified as a credential theft infrastructure designed to mimic legitimate login portals and harvest user authentication details. Analysis indicates the site likely targeted individuals through deceptive emails or messages, redirecting them to fraudulent pages where credentials were captured upon submission. The domain’s infrastructure shows no association with any legitimate service, and its sole purpose appears to be the unauthorized collection of sensitive information such as usernames, passwords, and potentially multi-factor authentication codes. Infrastructure analysis reveals the domain was registered on October 31, 2025, through NiceNIC International Group Co., Limited, and currently resolves to the IP address 31.57.61.109, hosted under AS56971 in Finland. Security vendors on VirusTotal flagged the domain as malicious, with 17 out of 95 engines detecting it as a threat. Additionally, the domain appears on two security blocklists, including PhishDestroy and PhishingDB, and lacks an SSL certificate, further indicating its illegitimate nature. The page title, '403 Forbidden,' suggests the site may have been taken offline or restricted following detection. Users who visited greenprox.cc or interacted with any content linked to this domain should immediately take corrective action. Any credentials entered on the site should be considered compromised and reset across all platforms where they were reused. Affected individuals are advised to monitor their accounts for unauthorized activity and enable multi-factor authentication where available. System scans using updated security tools are recommended to detect potential malware or follow-up threats. Organizations should block the domain and its associated IP address at the network level to prevent further exposure.