surfixapp[.]guildnet[.]info

PhishDestroy identifies surfixapp.guildnet.info as a newly active crypto drainer domain designed to siphon cryptocurrency from unsuspecting users. This domain resolves to IP address 188.114.97.3 and leverages a Let’s Encrypt SSL certificate to appear legitimate—potentially tricking users into connecting wallets or entering seed phrases. It has not yet been flagged on VirusTotal with 0 detections out of 95 scanners, indicating evasive tactics likely in use to bypass early detection systems. The domain remains under active investigation as new IOCs emerge, including behavioral patterns targeting crypto investors.

Technical analysis reveals minimal historic data, with no current inclusion on major threat intelligence blocklists. The domain’s Let’s Encose certificate suggests a short operational window intended to avoid prolonged scrutiny. Given the lack of detection and absence of historical reputation, this domain poses an elevated risk—particularly to users interacting with Web3 applications or cryptocurrency platforms. Its recent registration and clean VT score (3/95) indicate a high likelihood of active deployment in live campaigns, especially in social engineering vectors such as impersonating legitimate crypto services or NFT platforms.

If you visited surfixapp.guildnet.info, disconnect any connected wallets immediately and revoke permissions via your wallet provider’s interface. Do not enter any credentials or seed phrases. Scan your system with updated antivirus and consider rotating all wallet addresses and private keys exposed to this domain. Report the domain to your email provider, browser blocklists, and crypto platform security teams. Preserve any transaction logs or wallet interaction screenshots for forensic analysis. Monitor your accounts for unauthorized transactions—crypto drainers often initiate transfers within minutes of connection.