greenworktsools[.]com

The domain greenworktsools.com was registered on 21 February 2026 via Dynadot LLC and is currently hosted on IP 185.53.177.52, which belongs to AS61969 (Team Internet AG) in Germany. The site presents an HTTP 200 response and serves a Let’s Encrypt‑issued certificate (YR1). DNS resolution uses ns1.adtraks.com and ns2.adtraks.com as authoritative name servers. Intelligence indicates the site is being used for credential phishing, as classified under generic_phishing, and it is listed on two public blocklists (PhishDestroy and ScamSniffer). The page title returned by the server is “greenworktsools.com”, matching the domain name. VirusTotal analysis shows that three of ninety‑five security scanners flagged the domain, and Gridinsoft assigned a trust score of 0 / 100, reinforcing the malicious assessment. The domain’s risk level is rated high and its status is active as of 12 July 2026. No additional content analysis is available, so the specific tactics, lure content, or credential collection mechanisms remain unknown. Defenders should immediately block DNS resolution to 185.53.177.52 and add greenworktsools.com to URL filtering rules. Continuous monitoring of the associated IP range and the responsible ASN is advised, as is periodic re‑scanning to capture any changes in detection status.