guildtop[.]xyz

PhishDestroy identifies guildtop.xyz as an active credential-theft phishing domain designed to harvest user login credentials under the guise of a legitimate service. This domain employs social engineering tactics, presenting familiar branding or service interfaces to trick victims into entering their usernames and passwords into counterfeit login forms. Once harvested, these credentials are likely used for unauthorized account access, financial fraud, or further phishing campaigns targeting the victim’s contacts. The domain’s infrastructure lacks advanced obfuscation, relying instead on time-sensitive registration and hosting tactics to evade early detection while maintaining plausible deniability. This domain was flagged with 0 detections out of 95 VirusTotal engines, indicating its novelty and the challenge it poses to signature-based detection systems. It resolves to IP 188.114.96.3 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for accommodating high-risk domains. The domain was created on April 02, 2026, and is currently blocked by the OISD blocklist but remains active on one additional security blocklist. Its SSL certificate, issued by Let’s Encrypt, adds a veneer of legitimacy, further complicating user discernment. The combination of recent registration, minimal detection, and blocklist gaps suggests this domain is part of a rapidly evolving phishing operation aimed at exploiting user trust in familiar web interfaces. If you have interacted with guildtop.xyz—whether by visiting the site or entering credentials—immediately assume compromise. Revoke access to any accounts where the same password was reused, enable multi-factor authentication wherever possible, and conduct a full antivirus scan of your device. Monitor financial accounts and inboxes for unusual activity, as stolen credentials may be leveraged within hours. Report the domain to your organization’s security team or through public abuse channels to aid in blocking efforts. Avoid visiting or engaging with this domain in the future, and consider deploying network-level defenses to block traffic to 188.114.96.3 or the domain itself, should it reappear under a new guise.