guideviolation-x[.]click

The domain guideviolation-x.click was registered on February 23, 2026 through Atak Domain Bilgi Teknolojileri AS and resolves to 185.46.40.240, an address allocated to AS211401 (Atak Domain Bilgi Teknolojileri A.S.) in Turkey. The authoritative nameservers are p1.atakdomain.com and p2.atakdomain.com. The site presents a parked page with the title “guideviolation-x.click | Domain Parked”, indicating no active phishing landing page at the time of observation. However, the domain is classified as a generic phishing infrastructure and appears on three external blocklists, including PhishDestroy, MetaMask, and SEAL.

VirusTotal reports three of ninety‑three scanners flagging the domain, providing additional corroboration of malicious activity. The SSL certificate is issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36, which is commonly used by short‑lived malicious domains. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high likelihood of abuse. The current operational status is offline, suggesting that the phishing campaign has been taken down or the infrastructure is being rotated.

Despite the lack of a visible phishing page, the combination of recent registration, low‑reputation trust score, blocklist listings, and multiple vendor detections warrants continued monitoring. Defenders should add the domain and its associated IP address to deny‑list rules, enforce DNS sinkhole redirects, and watch for any re‑activation or similar newly registered domains from the same registrar or ASN. Continuous re‑scanning of the host and periodic checks against threat intelligence feeds are recommended to capture any resurgence of activity. The evidence base for this assessment consists of the registration metadata, DNS resolution, SSL certificate details, blocklist entries, VirusTotal detections, and the low trust score, while the exact phishing payload or targeted brand remains unverified pending further analysis.