greenprox[.]cc

PhishDestroy first observed greenprox.cc on Dec 12, 2025. Stored content metadata identifies Coinbase as the apparent target. The captured page title is “403 Forbidden”. Current evidence score: 100/100 (critical).

Positive findings are stored from 3 sources: VirusTotal, Spamhaus DBL, and URLScan. VirusTotal recorded 17 detections among 95 engines: ADMINUSLabs, Criminal IP, alphaMountain.ai, BitDefender, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Lionic, MalwareURL, Phishing Database, Seclookup, SOCRadar, Sophos, VIPRE, Webroot on Feb 23, 2026 at 07:11 UTC. Spamhaus DBL: DBL_SPAM on Jul 14, 2026 at 14:35 UTC. URLScan returned a malicious verdict with score 100; scan metadata linked the capture to Coinbase and assigned phishing as its category on Jul 29, 2026 at 03:31 UTC. Non-positive and contextual checks: Gridinsoft assigned a trust score of 1/100 (Suspicious); no observation timestamp was retained. AlienVault OTX listed 19 community pulse references (not vendor detections) on Mar 1, 2026 at 15:13 UTC. The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 02:20 UTC. URLQuery recorded no positive detection; no observation timestamp was retained. Google Safe Browsing returned no flag on Mar 3, 2026 at 04:14 UTC. PhishStats returned no feed match on Mar 2, 2026 at 03:03 UTC.

HTTP 502 was recorded on Aug 8, 2026 at 02:32 UTC; content was unavailable. Latest classified outcome: registration hold observed; cause registrar client hold; mechanism client hold; observed actor NICENIC INTERNATIONAL GROUP CO., LIMITED on Aug 7, 2026 at 01:55 UTC. Registration records for the domain list NiceNIC International Group Co., Limited as the registrar and Oct 31, 2025 as the creation date. At collection time, the hostname resolved to 31.57.61.109 on AS56971 (AS56971 CGI GLOBAL LIMITED, HK). The recorded endpoint location is Helsinki, FI. The stored server header is nginx. DOM analysis on Apr 23, 2026 at 11:21 UTC returned 0/100; the source detections above were recorded separately. The evidence archive retains 3 visual captures from PhishDestroy and URLScan.

The content indicators and 3 positive source findings support the current Coinbase impersonation and phishing classification. The target field identifies Coinbase, but the record does not establish whether the page requested credentials, a seed phrase, or a wallet connection.