guildedfinances[.]live

This domain, guildedfinances.live, is flagged as an active credential phishing portal designed to harvest user login credentials under the guise of legitimate financial advisory services. Analysis indicates the site mimics finance strategy platforms, employing social engineering tactics to deceive visitors into submitting sensitive account information. The threat type is specifically classified as a fake login portal, targeting individuals seeking financial management tools or investment advice. Infrastructure analysis reveals multiple high-risk indicators. The domain resolves to IP address 188.114.97.3, utilizes Cloudflare for hosting and protection, and was registered on February 21, 2026, through NiceNIC International Group Co., Limited. Security vendors on VirusTotal have flagged the domain, with 6 out of 95 engines detecting malicious activity. Additionally, the domain appears on one security blocklist and holds a Gridinsoft trust score of 0 out of 100. The SSL certificate is issued by Google Trust Services, which, while legitimate, is commonly exploited by threat actors to lend false credibility. The site employs PHP and Bootstrap frameworks, further aligning with typical phishing infrastructure patterns. Mitigation steps for this specific threat type include immediate cessation of interaction with the domain. Users who may have entered credentials should reset passwords for any financial accounts, enable multi-factor authentication, and monitor accounts for unauthorized transactions. Organizations should update web filters to block access to guildedfinances.live and its associated IP address. Security teams are advised to review logs for connections to 188.114.97.3 and investigate any credential submissions linked to this domain. Given the elevated risk level, proactive measures such as user education on recognizing phishing attempts and verifying domain authenticity are strongly recommended.