cleanandgreen[.]us

Analysis of the domain cleanandgreen.us indicates active credential-harvesting infrastructure targeting users of environmental service platforms. The domain was registered on May 27, 2026, through an undisclosed registrar and currently resolves to the IP address 13.248.169.48, which is geolocated in California and associated with AWS Global Accelerator. This IP has been flagged by three independent security blocklists, and the domain holds a trust score of 0/100, reflecting confirmed malicious activity. SSL certification is provided by GoDaddy.com, Inc., though this does not mitigate the domain's fraudulent purpose. As of July 12, 2026, the domain remains operational, returning an HTTP 200 status code, which suggests a live phishing interface. Twelve of ninety-one security vendors on VirusTotal have detected the domain as malicious, though the specific nature of the phishing content has not been fully analyzed. The domain is actively blocked by multiple security layers, including browser-based protections and cryptocurrency wallet filters, indicating a likely focus on financial or sensitive data theft. Defenders should treat this domain as high-risk and prioritize blocking at the network and endpoint levels. Given the use of cloud-based hosting and a recently issued SSL certificate, the infrastructure appears deliberately configured to evade initial suspicion. No legitimate association with environmental services or related brands has been established, and the domain should be considered entirely fraudulent until forensic analysis confirms otherwise.