guester-verif901840[.]com

This domain, guester-verif901840.com, is identified as a credential theft phishing site designed to harvest user login credentials through deceptive authentication prompts. The infrastructure mimics legitimate verification portals, likely targeting users through email or SMS campaigns directing victims to input sensitive information such as usernames, passwords, or multi-factor authentication codes. Analysis indicates the domain was structured to appear as an official verification service, increasing the likelihood of successful social engineering attacks against unsuspecting users. Infrastructure analysis reveals the domain was registered on November 28, 2025, through Hello Internet Corp and resolved to IP address 172.67.161.73, hosted on Cloudflare infrastructure (AS13335). It appears on two security blocklists and is flagged by 20 out of 95 security vendors on VirusTotal, indicating widespread detection as malicious. The SSL certificate, issued by Google Trust Services (WE1), was likely used to lend a false sense of legitimacy to the phishing page. The domain is currently offline, returning a 522 connection timeout error, but its prior activity and detection history confirm its malicious intent. Users who visited guester-verif901840.com should assume their credentials may have been compromised. Immediate actions include resetting passwords for any accounts accessed or entered on the site, enabling multi-factor authentication where available, and monitoring accounts for unauthorized activity. System scans for malware are recommended, as phishing sites may also distribute malicious payloads. Organizations should update security controls to block the domain and associated IP, and review logs for any prior connections to 172.67.161.73 or related infrastructure.