landguild[.]app

PhishDestroy identifies landguild.app as a generic crypto drainer phishing domain (seed: 004644) active in the wild. This domain was flagged for hosting a malicious interface mimicking a legitimate service, with infrastructure designed to deceive users into connecting crypto wallets to a drainer kit. While the specific impersonated brand is not yet confirmed, the domain exhibits hallmark behaviors of crypto fund stealers including obfuscated JavaScript payloads, clipboard manipulation, and transaction simulation prompts designed to trick users into approving malicious transactions. This domain was registered on May 04, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED, resolving to IP 104.21.36.52. VirusTotal currently shows 10/95 detection engines flagging the domain or its IP as malicious as of seed 004644. The SSL certificate was issued by Let's Encrypt, a common provider among phishing operators seeking low-friction deployment. Google Safe Browsing (GSB) status and comprehensive blocklist counts are not yet available in open intelligence feeds, indicating it is newly active and operating below detection thresholds. The risk profile remains elevated due to the rapid deployment of crypto drainer infrastructure and the domain’s recent creation. PhishDestroy has marked this threat as actively monitored with the status labeled as “under_investigation.” While no blocklists currently flag the domain, the absence of detections does not equate to safety. Users should avoid interacting with landguild.app and verify any suspected domains using PhishDestroy’s real-time validation tools. Remaining risk includes continued operation of the drainer kit and potential expansion to impersonate additional brands. Immediate countermeasures include network-level blocking of the IP (104.21.36.52) and domain, while threat intelligence teams continue tracing the certificate chain and registrar identity. Seed 004644 confirms this analysis.