greenw3[.]app

The domain greenw3.app is an active generic phishing site posing an elevated risk. It does not impersonate a specific brand or deploy a known drainer kit but is designed to harvest user credentials or other sensitive information through deceptive means. As of the latest verification, greenw3.app remains operational and has not been flagged by major security services like Google Safe Browsing, though it is detected by some threat intelligence sources.

Technical indicators for greenw3.app show limited but notable detection: 2 of 95 VirusTotal security vendors flag the domain, including Fortinet and SOCRadar. It is registered through NiceNIC International Group Co., Limited with a creation date of February 21, 2026, and resolves to the IP address 188.114.96.3, hosted on Cloudflare’s infrastructure (AS13335). The domain appears on one security blocklist (PhishDestroy) and uses an SSL certificate issued by Google Trust Services (WE1). The observed page title is 'Just a moment...', and the site returns an HTTP 502 status, suggesting possible intermittent availability or protective measures.

Users who may have interacted with greenw3.app should immediately change any credentials entered on the site and enable two-factor authentication (2FA) on associated accounts. Monitor financial and personal accounts for unauthorized activity. Report the domain to relevant authorities or platforms, such as the Anti-Phishing Working Group (APWG) at reportphishing@apwg.org or through local cybercrime reporting channels. If browser-based warnings appear, avoid proceeding to the site.