mj-api[.]kun-ai[.]com

This domain, mj-api.kun-ai.com, was actively used to impersonate Discord, a widely used communication platform, with the intent of credential theft. The phishing page displayed the title 'Discord - Group Chat That’s All Fun & Games,' mimicking legitimate Discord branding to deceive users into entering login credentials or other sensitive information. Analysis indicates this was not a generic phishing attempt but a targeted brand impersonation campaign designed to exploit trust in the Discord brand for malicious purposes. Infrastructure analysis reveals the domain was registered on July 07, 2023, through 22net, Inc., and resolved to the IP address 119.28.115.29, located in Singapore under AS132203. The domain was flagged by 19 out of 95 security vendors on VirusTotal, indicating a high level of detection and consensus regarding its malicious nature. Additionally, it appeared on two security blocklists and was explicitly blocked by PhishDestroy and PhishingDB. The SSL certificate was issued by Let's Encrypt (R12), a common tactic used by threat actors to lend a false sense of legitimacy to phishing sites. Users who visited mj-api.kun-ai.com should assume their credentials or other sensitive information may have been compromised. Immediate steps include resetting passwords for Discord and any other accounts where the same credentials were reused. Enable multi-factor authentication where available to mitigate further risk. Monitor accounts for unauthorized activity and review connected devices or sessions for signs of compromise. If financial or personal data was entered, consider reporting the incident to relevant authorities and credit monitoring services. Organizations should update blocklists to include this domain and its associated IP address to prevent further exposure.