verify[.]guildguardbot[.]xyz

Analysis of verify.guildguardbot.xyz shows a domain created on February 21, 2026 that is currently taken offline. The site presented a page title of "Just a moment..." and was served over TLS using a certificate identified as WE1. Network resolution points to the IP address 104.21.64.1, which belongs to AS13335 operated by Cloudflare, Inc., and is geolocated in the United States.

The domain has been added to a single security blocklist and is actively blocked by the PhishDestroy feed, indicating that threat intelligence sources have flagged it as malicious. VirusTotal records reveal that the domain was scanned by 95 independent security vendors, none of which reported a detection at the time of scanning; however, the absence of detections does not constitute confirmation of safety. The classification assigned by the provided intelligence is credential phishing, suggesting the domain was intended to harvest user credentials, though the specific target brand or service is not disclosed in the available data.

Defenders should treat the domain as hostile, add the IP address 104.21.64.1 to deny‑list rules where appropriate, and ensure that any outbound connections to Cloudflare‑hosted assets are inspected for anomalous credential‑collection activity. Continuous monitoring of threat feeds for updates on the domain’s status, as well as verification of any related URLs that may appear in phishing campaigns, is recommended. Organizations should also enforce multi‑factor authentication and educate users about unexpected login prompts, especially those that may redirect to domains with generic page titles such as "Just a moment...".