greendovemultiproject[.]com

This domain, greendovemultiproject.com, is currently flagged as an active high-risk phishing site targeting the real estate and property management sector. Registered on April 13, 2026, through OwnRegistrar, Inc., the domain resolves to IP address 148.72.153.160, hosted on infrastructure associated with velia.net in the United States. The site presents itself as 'Green Dove Multi-project Limited – Real Estate, Building Construction, Land and Property management,' as indicated by its page title, suggesting an attempt to impersonate a legitimate business in this industry. Infrastructure analysis reveals a 301 HTTP redirect, which may be used to funnel victims to a secondary malicious endpoint. The domain employs a Let's Encrypt SSL certificate (YR2), a common tactic among phishing sites to appear legitimate. Email routing is configured via Microsoft's Outlook protection service (greendovemultiproject-com.mail.protection.outlook.com), which could facilitate credential harvesting or business email compromise (BEC) attacks. Nameservers are hosted under afeeshost.ltd and afeeshost.com, entities not widely recognized for legitimate hosting services. The domain appears on one security blocklist and was flagged by a single vendor in a multi-engine scan, indicating early detection but not yet widespread recognition. The Gridinsoft trust score of 0/100 further supports its classification as malicious. While the exact phishing methodology remains unconfirmed due to limited public analysis, the combination of real-estate branding, recent registration, and low-reputation hosting infrastructure aligns with known phishing patterns. Defenders should treat this domain as actively malicious. Network-level blocking is recommended, particularly for organizations in the real estate, construction, or property management sectors. Monitoring for related domains using similar naming conventions or infrastructure (e.g., afeeshost nameservers) may help identify additional threats.