c-ninja[.]vercel[.]app

This domain, c-ninja.vercel.app, is identified as an active phishing resource specializing in brand impersonation targeting Discord, a widely used communication platform. Analysis indicates the site employs credential harvesting techniques, presenting itself under the page title 'Citrea Ninja' to deceive users into divulging login credentials or other sensitive information. The domain is structured to mimic legitimate Discord-themed pages, leveraging social engineering to exploit user trust in the targeted brand. Infrastructure analysis reveals the following technical indicators: the domain resolves to the IP address 216.198.79.195, hosted under Amazon.com, Inc.’s autonomous system AS16509 in the United States. It was registered through Vercel Inc. on January 28, 2020, and remains active under their infrastructure. The SSL certificate is issued by Google Trust Services (WR1), a common feature in both legitimate and malicious domains to evade basic security filters. Google Safe Browsing has explicitly flagged this domain as phishing, while VirusTotal reports detection by 11 out of 95 security vendors. Additionally, the domain appears on three distinct security blocklists, including those maintained by anti-phishing and web3 security entities. Current status confirms the domain remains operational, posing a high-risk threat to users. Despite detection by multiple security mechanisms, the domain continues to evade complete takedown, likely due to its hosting on a legitimate platform. Response actions should include immediate blacklisting by network security tools, browser-based warnings, and user education to recognize phishing indicators. The remaining risk is substantial, particularly for users unfamiliar with Discord’s official domain structure or those accessing the platform via unofficial links. Organizations are advised to monitor for credential exposure and enforce multi-factor authentication to mitigate potential account compromise.