guildwho[.]net

The domain guildwho.net is currently active and classified as a high‑risk generic phishing site. Registration records show the domain was created on November 16, 2025 and was registered through NiceNIC International Group Co., Limited. The authoritative name servers are braden.ns.cloudflare.com and dana.ns.cloudflare.com, indicating that the domain is fronted by Cloudflare infrastructure. DNS resolution points to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States.

The site presents an SSL certificate issued by Google Trust Services under the WE1 designation, and the underlying web server supports HTTP/3. A HTTP request returns a 200 status code, yet the page title returned is "guildwho.net | 522: Connection timed out," suggesting that the back‑end service is currently unavailable or intentionally delayed. VirusTotal analysis shows that 14 of 95 security vendors have flagged the domain, providing moderate consensus among scanners. The domain appears on three third‑party blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its malicious reputation.

No further details about the content or targeted brand have been observed beyond the generic phishing classification. Defenders should add guildwho.net to blocklists and network filtering rules, monitor outbound DNS queries for the associated Cloudflare IP range, and ensure that any credential‑capture detection heuristics are applied to traffic toward this domain. Continuous re‑evaluation is recommended, as the site remains active and may change its payload or targeting in future iterations.