guacamole-wetransfer-11rsanu9-elmahdysaf[.]4everland[.]app

This domain is assessed as an elevated-risk generic phishing endpoint designed to impersonate file-sharing workflows and mislead users into credential submission or malicious file interaction. The naming pattern indicates likely abuse of trusted file transfer branding combined with randomized subdomain generation to evade detection and tracking.

Technical telemetry shows VirusTotal detection at 18/95 security vendors. The domain is registered through Cloudflare, Inc., resolves to IP 172.67.136.240 under AS13335 Cloudflare, Inc., and uses SSL issued by Google Trust Services / WE1. It appears on 2 security blocklists and is actively flagged by PhishDestroy and PhishingDB. No creation date is provided in the dataset.

Mitigation requires immediate blocking of the domain at DNS and proxy layers, along with inspection of access logs for connections to 172.67.136.240. Users who interacted with the page should be treated as potentially compromised and prompted to reset credentials if any were entered. Additional controls should include monitoring for credential reuse, revocation of active sessions, and enhanced filtering for similar randomized subdomain structures used in phishing infrastructure.