greenw13[.]live

Analysis of greenw13.live, observed on 25 July 2026, classifies the site as a high‑risk generic phishing operation. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is currently resolved to the Cloudflare‑hosted address 172.67.70.228, ASN 13335 (Cloudflare, Inc.) located in the United States. The active nameservers clint.ns.cloudflare.com and meiling.ns.cloudflare.com confirm the use of Cloudflare’s DNS and edge services. TLS termination is provided by a Google Trust Services certificate issued for the WE1 trust store, indicating a valid SSL chain but offering no reputation benefit. HTTP requests return a 301 redirect, and the page title reported by the scanner reads “Nur einen Moment…”, a phrase that does not disclose the intended victim target.

Detected technologies include Cloudflare Browser Insights, Cloudflare itself, and HTTP/3, confirming the presence of modern CDN features. Reputation checks show the domain appears on a single security blocklist and is explicitly listed as blocked by PhishDestroy. On VirusTotal, 2 of 95 scanning engines flagged the domain, reinforcing the malicious assessment despite the low detection ratio. The Gridinsoft trust score is 0 / 100, indicating a lack of trust.

No additional intelligence such as Safe Browsing, OTX, or external evidence links is available at this time. Defenders should add greenw13.live to web filtering and DNS block lists, monitor outbound connections to the IP 172.67.70.228, and enforce TLS inspection to capture the 301 redirect payload. Because the site leverages Cloudflare’s infrastructure, standard IP reputation may be insufficient; correlation with the specific domain name is required. Continuous re‑evaluation is advised, as the domain remains active and could be used in future phishing campaigns.