geubax[.]com

Analysis indicates that the domain geubax.com was registered on July 25, 2026 and is currently active. The registration was performed through Fewmoretaps OU d/b/a Trustname.com, and the domain resolves to the IP address 188.114.96.3. DNS resolution is provided by the Cloudflare nameservers chase.ns.cloudflare.com and kira.ns.cloudflare.com, suggesting the use of Cloudflare’s DNS infrastructure for resilience or anonymity. The domain appears on one security blocklist and has been explicitly blocked by the PhishDestroy feed, confirming its identification as a malicious resource.

VirusTotal data shows that 2 of 91 security vendors have flagged the domain, providing independent vendor corroboration of its malicious nature. No additional public intelligence such as page title, SSL certificate details, or HTTP response codes is available at this time, leaving the exact content and lure technique of the site unverified. However, the classification as a generic phishing campaign implies that the site is likely being used to harvest credentials or personal data. Defenders should add geubax.com to local blocklists, enforce DNS filtering, and monitor outbound connections to the associated IP address 188.114.96.3.

Network traffic to the Cloudflare nameservers should be inspected for potential data exfiltration patterns. Incident response teams should also consider updating intrusion detection signatures to include the observed domain and registrar attributes. Continuous monitoring of the domain’s status on blocklists and vendor feeds is recommended, as further detection activity may surface additional indicators of compromise.