guakox[.]com

This domain is flagged as a high-risk credential harvesting phishing threat. Analysis indicates guakox.com was specifically engineered to mimic legitimate authentication portals, tricking users into submitting sensitive login credentials, financial details, or personal data. The domain exhibits characteristics consistent with targeted phishing campaigns, including the use of evasion techniques to bypass initial detection mechanisms. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 172.67.208.108 and was registered through Fewmoretaps OU d/b/a Trustname.com on May 24, 2026. It holds a Gridinsoft trust score of 1/100 and is flagged by 19 out of 95 security vendors on VirusTotal. The domain appears on four security blocklists and is actively blocked by MetaMask, PhishDestroy, SEAL, and OISD. The SSL certificate is issued by Let’s Encrypt, a common tactic to lend superficial legitimacy to malicious sites. The creation date discrepancy (2026) suggests potential domain spoofing or misconfiguration, a red flag for fraudulent activity. Mitigation steps for this threat include immediate blocking of the domain and its associated IP (172.67.208.108) at the network perimeter. Security teams should deploy indicators of compromise (IOCs) in endpoint detection and response (EDR) and security information and event management (SIEM) systems. User awareness training should emphasize identifying phishing URLs, particularly those using Let’s Encrypt certificates or mimicking authentication pages. Organizations are advised to enforce multi-factor authentication (MFA) for all external-facing services to mitigate credential theft risks. Logs from May 24, 2023, onward should be reviewed for connections to this domain or IP, as the creation date anomaly may indicate earlier malicious activity.