6093[.]greenfrienndlypaint[.]com

This domain, 6093.greenfrienndlypaint.com, is identified as a credential harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates no direct association with known brand impersonation or cryptocurrency drainer kits, though the infrastructure aligns with generic phishing campaigns designed to capture sensitive authentication details. The domain lacks explicit branding, suggesting a broad or opportunistic targeting strategy rather than a campaign tied to a specific organization or service. Infrastructure analysis reveals the domain was registered through Wild West Domains, LLC, and resolves to the IP address 144.172.99.189, hosted under AS14956 (RouterHosting LLC) in the United States. At the time of assessment, the domain was flagged by 18 of 95 security vendors on VirusTotal, with a presence on one additional security blocklist. No SSL certificate was detected, increasing the likelihood of interception or manipulation of transmitted data. The page title, '403 Forbidden,' suggests either misconfiguration, evasion tactics, or a placeholder state during the campaign's active phase. The domain has since been taken offline, likely following detection and reporting by security mechanisms. Despite its current inactive status, residual risk persists due to the potential for infrastructure reuse or re-registration under similar naming conventions. Organizations and users are advised to monitor for related indicators of compromise, including the IP address 144.172.99.189 and domains registered through the same registrar. Proactive blocking of the domain and associated IP at network and endpoint levels is recommended to mitigate future exposure.