watcherguru[.]xyz

Analysis of watcherguru.xyz confirms it as an active phishing domain targeting cryptocurrency users, specifically impersonating Watcher.Guru based on the page title. The domain was registered on August 13, 2024, through Dynadot LLC and currently resolves to IP 75.2.18.233 (AS16509, Amazon.com, Inc., US). It returns an HTTP 200 status, indicating a live, accessible site. Infrastructure analysis reveals the use of Node.js, Express, Envoy, HSTS, and Akamai technologies, suggesting a structured hosting environment likely designed to evade detection or scale operations. Security vendors have flagged the domain with low but consistent detections: 3 of 95 engines on VirusTotal identify it as malicious. It appears on three security blocklists (PhishDestroy, ScamSniffer, Enkrypt) and is referenced in two AlienVault OTX threat intelligence pulses, further corroborating its malicious nature. The SSL certificate is issued by GoDaddy.com, Inc., a common choice for both legitimate and fraudulent sites, and does not inherently indicate trustworthiness. Nameservers ns1.dyna-ns.net and ns2.dyna-ns.net are associated with the domain, though their reputation is not independently verified in this analysis. The domain's creation date (11 months prior to this report) aligns with typical phishing campaign timelines, where domains are registered in advance of active abuse. No specific phishing kit or brand impersonation beyond the page title ('watcher.guru') is confirmed, but the combination of infrastructure, blocklist presence, and threat intelligence pulses strongly indicates a deliberate scam operation. Defenders should treat this domain as high-risk and implement blocking at DNS, proxy, or endpoint levels. Network monitoring for connections to 75.2.18.233 or the domain itself is recommended, particularly in environments where cryptocurrency-related activity occurs.