guardan[.]io

The domain guardan.io was registered on February 21, 2026 through Name.com, Inc. and resolves to the Cloudflare‑owned address 172.67.131.96 (AS13335, United States). The authoritative name servers listed are ns3dgr.name.com, ns1fkl.name.com, ns4blx.name.com, and ns2btz.name.com. The site is protected by Cloudflare and serves HTTP/3 traffic, but it does not present an SSL/TLS certificate, and an HTTP request returns a 404 status code. The page title returned by the server is "Your NodeJS Droplet," which provides no indication of a specific target brand or service.

The domain is currently marked as offline, yet it continues to appear on at least one security blocklist and is actively blocked by the PhishDestroy service. Threat intelligence aggregators have recorded the domain in fifteen AlienVault OTX pulses, and VirusTotal analysis shows that sixteen of ninety‑three security vendors flagged the domain as malicious. No further technical details about the page content or payload have been disclosed.

Defenders should treat guardan.io as a confirmed malicious infrastructure element. Recommendations include adding the domain to URL filtering and DNS deny lists, monitoring for any re‑activation or new sub‑domains that resolve to the same Cloudflare IP range, and correlating internal logs for any HTTP requests to the domain before it went offline. Continuous observation of OTX and VirusTotal updates is advised to capture any evolving indicators of compromise associated with this host.