guildian[.]live

This domain was observed responding with the HTTP status “522: Connection timed out”, indicating that the origin server failed to respond within Cloudflare’s timeout window. Guildian.live resolves to the IP address 104.21.4.232, which is owned by Cloudflare, Inc. (AS13335) and is geolocated in the United States. The domain was registered on June 02 2025 through NiceNIC International Group Co., Limited and uses the Cloudflare nameservers braden.ns.cloudflare.com and dana.ns.cloudflare.com. The TLS certificate presented is issued by Google Trust Services under the WE1 intermediate, confirming a valid HTTPS configuration despite the service outage.

VirusTotal has recorded 14 detections out of 93 scanned scanners, and three independent blocklists have already listed the domain. Additional defensive products—PhishDestroy, MetaMask, and SEAL—have flagged the host, reinforcing the assessment that it is being used for malicious purposes. The Gridinsoft trust score of 30 / 100 further reflects a low reputation. Detected technologies include Cloudflare’s edge network and HTTP/3 support, which are typical for fast‑forwarding malicious infrastructure.

The available evidence points to a generic phishing operation, but the exact payload, target brand, or credential‑stealing kit has not been captured because the site is currently offline. No Safe Browsing or OTX entries were provided, and no further content analysis is available. Defenders should continue to block the domain at the DNS and proxy layers, monitor for any re‑appearance of the host on the same IP range, and consider adding the IP address 104.21.4.232 to network‑wide deny lists. Incident response teams should also correlate any recent phishing reports that reference guildian.live, and threat‑intel platforms should retain the current indicators of compromise for future attribution.