guarahelp[.]com

Analysis of guarahelp.com shows that the domain was registered on 11 September 2025 through Namecheap Inc and is hosted on Cloudflare’s network (AS13335) with the IP address 172.67.164.143 located in the United States. The authoritative name servers are corey.ns.cloudflare.com and dawn.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. The site presented a TLS certificate issued by Google Trust Services under the WE1 intermediate, confirming that HTTPS was available at some point. An HTTP request to the root returned a 404 status code, and the domain is currently taken offline.

Threat intelligence flags the domain as a generic phishing site; it appears on one security blocklist and is actively blocked by the PhishDestroy feed. VirusTotal reports that 2 of 91 scanned security vendors flagged the domain as malicious, providing additional corroboration of malicious intent. No public page title or content analysis is available, and the site’s exact phishing payload or target brand has not been disclosed.

Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurrection or repurposing of the IP address, and consider adding the domain to internal blacklists. Because the domain is already offline, investigation of any compromised credentials should focus on the timeframe prior to takedown. Ongoing observation of the associated Cloudflare IP range is advised, as it may host additional malicious actors.