guarda-wallet[.]io

The domain guarda-wallet.io was registered on August 27, 2025 through Immaterialism Limited and is currently taken offline. It was observed serving a page with the title "Guarda Wallet" and presented a valid Let's Encrypt R13 certificate, indicating TLS termination was correctly configured. Infrastructure analysis shows the domain resolves to the IP address 64.29.17.1, which belongs to Amazon.com, Inc. (AS16509) and is physically located in the United States. The hosting environment is identified as Vercel, with HTTP Strict Transport Security (HSTS) enabled, suggesting an attempt to enforce secure connections.

The site was flagged by PhishDestroy and returned an HTTP 451 status, which denotes unavailable for legal reasons, reinforcing the likelihood of malicious intent. VirusTotal scans reported 13 detections out of 95 security vendors, confirming that a significant portion of the security community classifies the domain as malicious. The domain appears on a single security blocklist, and its nameservers are hosted by njalla (1-you.njalla.no, 2-can.njalla.in, 3-get.njalla.fo), a provider commonly used by threat actors to obscure ownership. The listed scam type is "Crypto Scam" and the operational profile aligns with a crypto drainer, where attackers aim to harvest cryptocurrency credentials or funds.

While the page title is known, the exact content and user‑facing components have not been publicly disclosed, leaving some uncertainty about the specific phishing vector employed. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists, and monitor the associated IP and name server ranges for related activity. Threat intelligence teams are advised to enrich this indicator with any observed payload hashes or command‑and‑control endpoints that may emerge from future investigations.