greenaddress[.]info

greenaddress.info was observed hosting a page titled “GreenAddress Wallet – Secure, Non‑Custodial Bitcoin Wallet with Multi‑Signature Protection”. The title directly references the legitimate GreenAddress service, indicating a brand‑impersonation attempt targeting Bitcoin users. DNS resolution points to IP 91.222.173.30, which resolves to a network in the Netherlands owned by AS43641 SOLLUTIUM EU Sp z.o.o. The domain uses the ns1-us.v-sys.org and ns2-us.v-sys.org name servers, both associated with the Vsys_USA registrar. The TLS certificate presented is issued by DigiCert Inc under the “Encryption Everywhere DV TLS CA - G2” authority, showing a valid‑looking HTTPS endpoint despite the malicious intent. The web server responded with HTTP status 200 and was identified as Nginx behind Google Cloud CDN, confirming the use of Google Cloud infrastructure.

Automated analysis by Gridinsoft assigned a trust score of 0 / 100, and a single security blocklist listed the domain. PhishDestroy has recorded the domain as blocked, and VirusTotal reported a single positive detection among 93 scanned vendors, reinforcing the suspicion of malicious activity. The site is currently offline, which may be the result of takedown efforts or temporary suspension. Available intelligence confirms the domain’s classification as a “Wallet/Seed Phishing” campaign, aiming to harvest cryptocurrency wallet credentials or seed phrases. The exact content of the page beyond the title has not been captured, leaving uncertainty about the specific phishing fields or data collection mechanisms in use.

No additional evidence such as malicious payloads, redirects, or credential‑stealing scripts has been published. Defenders should block network connections to 91.222.173.30 and add greenaddress.info to URL filtering policies. Monitoring of the ns1-us.v-sys.org and ns2-us.v-sys.org name servers for future registrations can provide early warning of similar campaigns.