guest-confirmas873[.]com

This domain, guest-confirmas873.com, is identified as a credential harvesting phishing site designed to mimic legitimate authentication portals. Analysis indicates no direct association with known brand impersonation campaigns or drainer kits, suggesting a generic but targeted approach to stealing user credentials. The infrastructure lacks overt branding, increasing the risk of broad applicability across multiple sectors. Infrastructure analysis reveals the domain was registered on February 21, 2026, an anomalous future date likely intended to evade temporal detection mechanisms. It resolves to IP address 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.), a common tactic to obscure origin and leverage CDN-based protections. VirusTotal detection shows 20/95 security vendors flagging the domain as malicious, while it appears on 2 independent security blocklists. The SSL certificate is classified as WE1, a low-trust indicator often associated with ephemeral phishing infrastructure. No Google Safe Browsing (GSB) entries were recorded at the time of analysis. The domain is currently offline, likely due to takedown actions or operational rotation by threat actors. Despite its inactive status, residual risk persists for users who may have interacted with the site prior to deactivation. Organizations are advised to block the domain and IP at perimeter defenses, monitor for credential reuse attempts, and conduct retrospective log analysis for connections to 188.114.97.3. The anomalous creation date and Cloudflare hosting warrant continued scrutiny of related infrastructure.