discordloginpage[.]vercel[.]app

Analysis identifies discordloginpage.vercel.app as an active credential phishing operation designed to harvest user authentication data through a fake login interface. The observed page title is "Discord", indicating brand impersonation intended to increase victim trust and improve credential capture rates. Based on the available intelligence, the domain remains active and presents a high-risk threat profile due to its ability to collect account credentials from unsuspecting users.

Technical assessment shows that the domain is flagged by 17 of 95 security vendors, demonstrating a significant level of detection across security telemetry sources. The domain was created on March 28, 2026 and is registered through Vercel. DNS resolution currently points to IP address 216.198.79.67, located in the United States and associated with CYPRESS COMMUNICATIONS, LLC. Infrastructure review indicates the site is protected by an SSL certificate issued by Google Trust Services / WR1. The domain appears on 1 security blocklist and has been reported by PhishDestroy. While HTTPS may provide encrypted transport, it does not reduce the phishing risk posed by the content hosted on the domain.

At the time of analysis, the domain status remains active, increasing the likelihood of continued credential theft attempts. The combination of brand impersonation indicators, active hosting status, 17/95 detection results, and existing blocklist presence supports classification as a high-risk credential phishing threat. Recommended actions include immediate blocking of the domain and associated IP address 216.198.79.67 at network security controls, monitoring authentication logs for potential compromise attempts linked to this campaign, reviewing user reports for exposure, and initiating credential resets for any accounts that may have interacted with the phishing page. Continued monitoring is advised until the infrastructure is confirmed inactive or removed.