decentralizedchain[.]on[.]fleek[.]co

Analysis of decentralizedchain.on.fleek.co indicates active brand impersonation targeting Discord users. The domain, registered on March 6, 2020, through 1API GmbH, resolves to Cloudflare-hosted infrastructure (IPv6: 2606:4700:20::681a:ed3) and uses a Google Trust Services SSL certificate. As of July 12, 2026, the domain remains operational and is flagged by five security blocklists, including Polkadot, Codeesura, ScamSniffer, PhishDestroy, and Enkrypt. Gridinsoft assigns a trust score of 0/100, reflecting high-risk classification. VirusTotal reports 11 detections from 95 security vendors, though the specific detection rules are not disclosed in available intelligence. The domain's subdomain structure (on.fleek.co) suggests use of a decentralized hosting service, a pattern observed in phishing campaigns leveraging free or low-cost infrastructure to evade takedowns. While the exact content of the site has not been analyzed, the combination of Discord impersonation, Cloudflare obfuscation, and multi-vendor detections aligns with credential harvesting or malware distribution tactics. Defenders should treat this domain as confirmed malicious and prioritize blocking at the network and endpoint levels. Further investigation into associated IPs, certificate reuse, and hosting provider abuse reports may reveal additional linked infrastructure.