grafana[.]evergreenfin[.]ltd

The domain grafana.evergreenfin.ltd is currently classified as an active generic phishing site with an elevated risk rating. Infrastructure analysis shows the domain is listed on a single security blocklist and is explicitly blocked by the PhishDestroy filtering service, indicating that at least one reputable anti‑phishing vendor has observed malicious activity originating from the host. VirusTotal scans report that 12 of 91 security vendors have flagged the domain as malicious, providing a modest consensus of detection across multiple analytics engines.

No further public intelligence—such as registrar details, IP address attribution, SSL certificate information, or HTTP response codes—has been disclosed in the available data set, leaving those aspects of the infrastructure unverified at this time. The limited but consistent detection signals suggest that the domain is being used to host phishing content, though the specific payload, target brand, or credential‑harvesting mechanisms have not been publicly confirmed.

Defenders should continue to enforce blocklist rules that include this domain, monitor outbound traffic for connections to its host, and consider adding the domain to internal URL filtering policies. Ongoing observation of threat‑intel feeds for additional vendor detections or expanded blocklist listings is recommended to refine the threat profile as more evidence becomes available.