discord-webdappextension[.]com

This domain, discord-webdappextension.com, is flagged as a credential theft operation targeting users of the Discord platform. Analysis indicates the site mimics legitimate web3 extension authentication flows to harvest login credentials, likely for account takeover or further malicious activity. No direct ties to known crypto drainer kits were observed, but the infrastructure aligns with credential harvesting campaigns impersonating communication platforms. Infrastructure analysis reveals the domain was registered on April 01, 2026, through Spaceship, Inc., and resolves to the IP address 216.198.79.1. Security vendor detections on VirusTotal report 15/95 flags, while the domain appears on one security blocklist. Cloudflare technologies, including Cloudflare Browser Insights and HTTP/3, were detected, which may have been leveraged to obfuscate malicious activity. The page title 'Just a moment...' suggests the use of anti-bot or cloaking mechanisms to evade automated scanning. The domain is currently offline, likely due to takedown or suspension. However, residual risk remains for users who may have interacted with the site prior to its deactivation. Organizations are advised to monitor for compromised credentials tied to this domain and implement additional authentication controls for affected accounts. Network-level blocking of the resolved IP and registrar-based domains is recommended to mitigate potential follow-up campaigns.