confirm-guest6465734211[.]com

The domain confirm-guest6465734211.com is identified as a fake login portal designed to harvest user credentials. Analysis indicates the site operated under the guise of a legitimate authentication page, though no specific brand impersonation has been confirmed at this time. The domain is currently offline, but prior activity suggests it was actively targeting users through deceptive login prompts to capture sensitive information such as usernames, passwords, and potentially multi-factor authentication codes. Infrastructure analysis reveals the domain was registered through Dynadot Inc on November 11, 2025, and resolved to the IP address 188.114.96.3, hosted on Cloudflare’s network (AS1335). Security vendors flagged the domain as malicious, with 17 out of 95 VirusTotal engines detecting phishing-related activity. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, further corroborating its malicious classification. The SSL certificate is classified under the WE1 trust tier, indicating a low level of validation and potential misuse for fraudulent purposes. The page title, 'One moment...,' suggests the use of evasion techniques to delay or obscure detection by security tools. Current status confirms the domain has been taken offline, reducing immediate risk to end users. However, the infrastructure and registration details remain relevant for historical analysis and potential future threats. Organizations and individuals are advised to block the domain at the network level and monitor for any re-emergence under similar naming conventions or IP associations. Users who may have interacted with the domain should reset credentials for any accounts accessed during the exposure window and enable multi-factor authentication where available. Security teams should review logs for connections to 188.114.96.3 and the domain itself to identify potential compromise.