greyhoundlabs[.]info

Analysis as of July 19, 2026 confirms that greyhoundlabs.info is an active phishing infrastructure. The domain resolves to the Cloudflare‑hosted address 172.67.138.238, located in Canada, and serves HTTP 200 responses over TLS using a Google Trust Services / WE1 certificate, indicating a legitimate‑looking encryption layer. Nameservers zahir.ns.cloudflare.com and georgia.ns.cloudflare.com further confirm reliance on Cloudflare’s DNS services. Registration was completed through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar commonly used for disposable domains. The site is listed on the PhishDestroy blocklist, and five of ninety‑one VirusTotal scanners have flagged it, providing independent corroboration of malicious intent. While the specific phishing lure (e.g., targeted brand or credential‑capture page) has not been publicly disclosed, the combination of active hosting, valid TLS, and blocklist inclusion signals a high‑risk profile. Defenders should block outbound connections to 172.67.138.238, add greyhoundlabs.info to URL filtering policies, and monitor for related Cloudflare‑associated indicators. Continuous re‑evaluation is advised, as the threat actor may modify content or shift hosting while retaining the same domain registration details.