guardianassetrecovery[.]com

Analysis of guardianassetrecovery.com indicates an active generic phishing campaign targeting seed phrase credentials. The domain, registered through NameCheap on August 31, 2025, resolves to IP 69.48.203.207, which is hosted in the United States under ASN 8560 (IONOS SE). The web server returns HTTP 200 and serves a page titled “Guardian Asset Recovery | Helping you recover unclaimed property and financial assets securely and efficiently.” Technical fingerprints show a WordPress stack with MySQL, PHP, Nginx, and jQuery components, protected by HSTS and a Let’s Encrypt certificate (R12). The site is listed on a single security blocklist and has been blocked by PhishDestroy. VirusTotal reports two detections out of ninety‑five scanners, and Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. Nameservers abdullah.ns.cloudflare.com and lia.ns.cloudflare.com point to Cloudflare DNS infrastructure. While the page content has not been directly examined, the classification as a “Seed Phrase Theft” scam aligns with the observed indicators. Uncertainty remains regarding the exact payload delivered to victims and any additional command‑and‑control infrastructure. Defenders should block the domain and its associated IP at perimeter devices, monitor DNS queries for the listed Cloudflare nameservers, and incorporate the domain into threat‑intel feeds. Continuous re‑evaluation is advised in case further detections emerge or the infrastructure evolves.