lolz[.]guru

Analysis of the domain lolz.guru indicates it is actively used for phishing. The site returns an HTTP 301 redirect and is hosted behind Cloudflare (IP 172.67.223.126, located in Canada). SSL is provided by Google Trust Services under the WE1 certificate, confirming the use of a legitimate certificate authority. The domain is registered via Squarespace Domains II LLC and uses Cloudflare nameservers beth.ns.cloudflare.com and greg.ns.cloudflare.com. Reputation data shows the domain appears in four AlienVault OTX pulses, is listed on one public blocklist, and has been blocked by the PhishDestroy sinkhole. VirusTotal scans have flagged the domain by three of ninety‑one security vendors, reinforcing the malicious classification. MX records are present (priority 3 route1.mx.cloudflare.net, priority 22 incomplete), suggesting email capabilities for credential harvesting. The evidence collectively confirms a high‑risk phishing infrastructure, but the specific landing page content and targeted brand have not been publicly disclosed. Defenders should block the domain at network perimeter, add it to DNS sinkhole lists, monitor for related C2 traffic, and update email filters to quarantine messages that reference lolz.guru. Ongoing observation is recommended to capture any evolving payloads or credential‑stealing forms.