guwau[.]com

The domain guwau.com was observed hosting a page titled “Guwau: Elon Musk’s Official Crypto Casino Powered by Blockchain”. The site was registered on 21 February 2026 through REALTIME REGISTER B.V. and resolves to the IP address 172.67.221.232, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate was presented, indicating the site was served over plain HTTP. Analysis by multiple threat intelligence services shows a consistent malicious profile. Gridinsoft assigned a trust score of 1 out of 100, the lowest possible rating.

VirusTotal recorded 16 positive detections out of 93 scanned engines, confirming that a substantial portion of security vendors classify the domain as malicious. The domain appears on a single security blocklist and was actively blocked by the PhishDestroy service. The observed content aligns with a crypto‑focused scam, and the underlying infrastructure matches the “Gambler Scam” phishing kit, which is commonly used to lure victims into fraudulent cryptocurrency gambling operations. The risk level is listed as elevated, and the current operational status is offline, suggesting the campaign has been taken down or is temporarily unavailable. Defenders should treat guwau.com as a confirmed malicious indicator.

Immediate actions include adding the domain to blocklists, ensuring DNS filtering solutions deny resolution, and monitoring for any related command‑and‑control infrastructure that uses the same Cloudflare IP range. Because the site leveraged a high‑profile brand name in its title, threat‑intel feeds should be updated to reflect the association with Elon Musk‑related impersonation attempts. Continuous observation of the registrar REALTIME REGISTER B.V. for new domains with similar creation dates may reveal further campaign expansions.