greenevfleet[.]org

Analysis of greenevfleet.org indicates that the domain was registered on February 16, 2026 through GoDaddy.com, LLC and is using the default GoDaddy nameservers ns31.domaincontrol.com and ns32.domaincontrol.com. The domain resolves to the IPv4 address 185.158.133.1, which remains active as of the report date. The infrastructure has been listed on a single public phishing blocklist and is actively blocked by the PhishDestroy service, confirming that security operators have observed malicious activity associated with the domain.

VirusTotal records show that the domain has been scanned by 91 anti‑malware vendors; none of the scanners reported a detection at the time of analysis, but the absence of detections does not constitute a validation of legitimacy. No public information is available regarding SSL/TLS configuration, HTTP response codes, page title, or any additional reputation scores, leaving those aspects of the host unverified. The limited data set prevents a definitive attribution of the phishing campaign’s target or payload, and the exact content served by the site has not been captured.

Defenders should continue to block the domain at perimeter and DNS filtering layers, monitor outbound connections to 185.158.133.1, and consider adding the domain to internal blocklists. Further investigation, such as retrieving the landing page content, performing TLS certificate analysis, and correlating any observed credential harvesting attempts with this infrastructure, is recommended to clarify the threat scope and to support incident response actions. Ongoing surveillance of the domain’s status on additional blocklists and future VirusTotal scans is advised.