launcher[.]guarda[.]ltd

Analysis of launcher.guarda.ltd on July 23, 2026 identifies it as a crypto scam domain operating under an elevated risk classification. The domain resolves to 172.67.133.38, an IP address assigned to AS13335 (Cloudflare, Inc.) in the United States. No SSL certificate is present, increasing susceptibility to interception and reducing user trust indicators. The page title, 'Web Multi-currency Wallet | Guarda,' suggests an attempt to impersonate the legitimate Guarda cryptocurrency wallet service, though no direct evidence of a phishing kit or exact mimicry tactics is available from current intelligence.

Detection data from VirusTotal indicates 13 of 95 security vendors have flagged this domain, reflecting moderate but not universal consensus on its malicious nature. The domain appears on one security blocklist, specifically PhishDestroy, which has actively blocked it. Gridinsoft assigns a trust score of 0 out of 100, reinforcing its classification as high-risk infrastructure. No nameserver details or registrar information were provided in the available intelligence, limiting further attribution analysis.

Infrastructure analysis reveals the domain is currently offline, though this status may change. Defenders should treat this domain as actively malicious for retrospective hunting and proactive blocking. Network security teams are advised to add launcher.guarda.ltd and its resolving IP (172.67.133.38) to deny lists, monitor for historical connections, and alert users who may have interacted with the domain prior to its takedown. No additional context on campaign duration, victim count, or associated threat actors is available at this time.