gurusconnect[.]biz

Analysis indicates that the domain gurusconnect.biz was registered on 21 February 2026 and is currently taken offline. The site presented the page title “Coins hub – We are here to help you resolve your crypto related issues,” suggesting a crypto‑related phishing lure. The host resolves to 194.36.191.196, an address allocated to AS60117 (Host Sailor Ltd) in the Netherlands. The TLS certificate is identified as type R12, but no further certificate details are provided.

The domain appears on four independent security blocklists and has been flagged by 14 of 95 VirusTotal scanners, confirming malicious classification by multiple vendors. AlienVault OTX records the domain in one threat‑intelligence pulse, reinforcing its reputation as a phishing vector. Defensive controls that rely on blocklist lookups, DNS filtering, or TLS inspection will likely already block access, but organizations should verify that their filtering solutions include the four blocklists referenced. Because the site is offline, the precise phishing workflow, form fields, and any redirect chains remain unverified.

Nonetheless, the combination of a recent registration, crypto‑focused title, host location, blocklist presence, and multi‑vendor detections warrants a high‑risk rating. Defenders should add gurusconnect.biz to internal deny lists, monitor DNS queries for the resolved IP, and consider isolating any internal hosts that have recently contacted this address. Continuous re‑scanning of the domain, especially if it reappears, is recommended to capture any changes in payload or hosting. The evidence base currently consists of blocklist entries, VirusTotal detections, OTX pulse, and the observed page title; no additional artifacts such as malware hashes or payload samples have been disclosed.