verify-guild[.]vercel[.]app

Analysis of verify-guild.vercel.app, created on 21 February 2026 and hosted on Vercel infrastructure (IP 64.29.17.195, ASN AS16509 Amazon.com, Inc.), indicates a credential‑phishing operation that has been taken offline. The domain resolves to a US‑based Amazon hosting address and presents an HTTPS certificate issued by Google Trust Services under the WR1 intermediate, confirming proper TLS deployment. HTTP response returns a 404 status with the page title “404: NOT_FOUND”, consistent with the current offline state. Threat intelligence classifies the site as a credential‑phishing scam; it is listed on the PhishDestroy blocklist and appears on one additional security blocklist.

VirusTotal analysis shows a single detection out of 93 scanners, providing limited but corroborating evidence of malicious intent. The site’s technology stack includes Vercel and HTTP Strict Transport Security (HSTS), typical of many legitimate services, which may obscure its malicious nature. Registration was performed through Tucows Domains Inc., a common registrar, offering no direct indication of malicious intent. Because the content is not publicly accessible, the exact phishing lure or target brand remains unknown; only the generic “credential phishing” label is confirmed.

Defenders should continue to block the domain and its associated IP address at network perimeter devices, update URL filtering and DNS sinkhole lists, and monitor for any re‑activation or similar domains registered by the same registrar. Additional inspection of TLS certificates and correlation with other domains sharing the same IP or ASN can help identify related infrastructure. Continuous threat‑intel feeds should be consulted for new detections, and any future hits on the domain should be escalated for deeper forensic analysis.