guiaderotaslivre[.]com

Analysis of guiaderotaslivre.com indicates that the domain is actively being used for phishing operations as of the report date, July 26 2026. VirusTotal scans have returned three positive detections out of ninety‑one submitted security vendors, confirming that multiple independent scanners have identified malicious behavior associated with the host. The domain remains reachable, returning HTTP 200 responses, which suggests that the malicious payload or credential‑harvesting page is currently live.

Infrastructure data shows the domain is hosted on Cloudflare, as evidenced by the authoritative name servers cris.ns.cloudflare.com and jillian.ns.cloudflare.com. Registration information reveals that the domain was purchased through NameCheap, Inc., a registrar frequently leveraged by threat actors for rapid acquisition and anonymity. The domain appears on a single security blocklist and is explicitly listed by PhishDestroy, reinforcing the consensus among threat‑intelligence feeds that it should be treated as hostile.

No additional public indicators such as Safe Browsing warnings, OTX tags, SSL certificate details, or page‑title metadata have been disclosed, leaving those aspects of the threat surface unverified at this time. Consequently, defenders should block network connections to guiaderotaslivre.com at the perimeter, add the domain to host‑based allow‑list exclusions, and monitor for any outbound traffic from internal assets attempting to resolve or contact the domain. Continuous re‑evaluation is advised, as further analysis may uncover new indicators such as payload signatures, IP address origins, or compromised credential patterns that could refine detection rules.