stemguard-verify[.]world

PhishDestroy identifies stemguard-verify.world as a high-risk credential phishing domain targeting unsuspecting users with a fake 'Sign In' page. This domain mimics legitimate authentication portals to harvest login credentials, posing a severe risk to account security. The infrastructure lacks legitimate branding but employs deceptive design to trick victims into surrendering sensitive information. No confirmed drainer kit or specific brand impersonation has been linked to this domain at this time. This domain resolves to IP address 188.114.96.3 and is registered through PDR Ltd. d/b/a PublicDomainRegistry.com. VirusTotal reports a detection ratio of 9/95 security vendors, indicating significant malicious reputation. The domain was created on May 06, 2026, and utilizes a Let's Encrypt SSL certificate for added legitimacy. Google Safe Browsing (GSB) and multiple blocklists have flagged this domain, though it remains accessible. These combined indicators confirm active malicious operations. As of this assessment, stemguard-verify.world is still active and distributing phishing content. Immediate actions include blocking the domain at network and endpoint levels, and educating users to avoid submitting credentials on unverified pages. While the domain is currently live, proactive blocking and awareness can mitigate further compromise. Remaining risk is high due to active operation and low time-in-market, which suggests rapid evolution of tactics. Users should treat this domain as hostile and refrain from interaction.