v1-wf-09012026[.]greenulus[.]click

This domain, v1-wf-09012026.greenulus.click, is flagged as a high-risk generic phishing site targeting the Greentree brand, based on its page title. Registered on August 4, 2024, through united domains AG, it resolves to IP address 77.42.67.175 and remains active as of July 12, 2026. The domain appears on one security blocklist and is detected by 4 of 95 security vendors on VirusTotal. Infrastructure analysis reveals the use of Node.js, React, Nginx, Next.js, and Webpack, which are common in both legitimate and malicious web applications but often employed in phishing kits for scalability and obfuscation. The SSL certificate is issued by Let's Encrypt, a neutral indicator not inherently malicious or trustworthy. No specific phishing kit or campaign has been attributed to this domain in available intelligence, and the exact content or lure remains unconfirmed. Defenders should treat this domain as malicious due to its blocklist presence, vendor detections, and association with a known brand in its page title. Recommended actions include blocking the domain and IP at perimeter defenses, monitoring for connections from internal hosts, and investigating any credential submissions or downloads originating from this infrastructure. Further analysis of captured traffic or endpoint telemetry may clarify the phishing mechanism or targeted user groups.