app-guarda[.]io

Analysis of the domain app-guarda.io indicates it was a crypto-focused phishing site targeting users of the Guarda Wallet brand. The domain was registered on October 8, 2025, through Immaterialism Limited and resolved to the IP address 216.198.79.65, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The page title explicitly displayed 'Guarda Wallet,' aligning with the scam type labeled as a crypto scam in available threat intelligence. Infrastructure analysis reveals the domain used nameservers associated with Njalla (1-you.njalla.no, 2-can.njalla.in, 3-get.njalla.fo), a provider often utilized for privacy-focused or malicious hosting. The SSL certificate was issued by Let's Encrypt (R13), a common choice for both legitimate and fraudulent sites.

At the time of assessment, the domain returned an HTTP 451 status, indicating it was taken offline or restricted, though the specific reason for this status code remains unverified. Detection data shows the domain was flagged by 4 of 95 security vendors on VirusTotal and appeared on one security blocklist, with PhishDestroy explicitly listing it as blocked. The presence of HSTS and Vercel in the detected technologies suggests an attempt to mimic legitimate web security practices while leveraging a modern hosting platform. No evidence links this domain to a known phishing kit or additional malicious infrastructure beyond the provided indicators.

Defenders should treat this domain as a confirmed phishing threat, particularly for users of crypto wallets. The domain's registration date, hosting details, and detection metrics provide sufficient evidence for blocking at the DNS or network level. Further investigation into associated IP addresses or SSL certificates may reveal additional related threats. The exact content or functionality of the phishing page remains unanalyzed, but the available indicators align with typical crypto scam patterns.