greenwex[.]com

On 22 July 2026 the domain greenwex.com was observed to be offline but earlier exhibited characteristics of a social‑media phishing campaign. The site was registered on 21 February 2026 through Hello Internet Corp and is hosted on Cloudflare infrastructure, resolving to the IP address 172.67.220.173 owned by AS13335 Cloudflare, Inc. in the United States. DNS resolution uses the Cloudflare nameservers hatie.ns.cloudflare.com and jarred.ns.cloudflare.com, and the TLS certificate is issued by Google Trust Services under the WE1 intermediate, indicating a valid HTTPS endpoint. The page title retrieved prior to takedown read “GREENWEX | Open the world of luck and rewards!”, which aligns with the claimed lure of rewards often used in social‑media phishing lures.

Threat intelligence aggregators flagged the domain: three of ninety‑three VirusTotal scanners raised detections, and the domain appears on a single external blocklist. PhishDestroy listed the site as blocked, confirming that at least one dedicated anti‑phishing service recognized it as malicious. Gridinsoft assigned a trust score of 1 out of 100, reinforcing the low reputation. No additional technologies beyond Cloudflare were observed.

The evidence points to an active phishing infrastructure that was taken down shortly after detection. However, the exact content of the landing page, credential‑capture mechanisms, and target social platforms have not been captured in the current dataset, leaving those details uncertain. Defensive operators should continue to block the IP address 172.67.220.173 and the domain greenwex.com at network perimeter and DNS layers, monitor for any re‑registration attempts, and incorporate the domain into threat‑intel feeds. Ongoing surveillance of Cloudflare‑associated IP ranges and the registrar Hello Internet Corp may help identify related campaigns that reuse similar infrastructure.