lewwk[.]net

Analysis of lewwk.net indicates a short-lived infrastructure designed to impersonate the Discord brand. The domain was registered on February 21, 2026 through Tucows Domains Inc. and points to the Cloudflare edge address 172.67.182.220, which is associated with AS13335 Cloudflare, Inc. in the United States. DNS resolution uses the Cloudflare authoritative nameservers dean.ns.cloudflare.com and priscilla.ns.cloudflare.com, confirming that the site leveraged Cloudflare’s CDN and protection services. The site presented an HTTP 403 response at the time of capture, and the TLS certificate was issued by Google Trust Services under the WE1 certificate profile, indicating a valid‑looking HTTPS endpoint.

The page title observed was "Vote Bertram The Pomeranian (Bert) - Current Rank #1 | Lewk | Lewk," which bears no direct reference to Discord, suggesting that the malicious landing page content was either altered or not yet examined. Reputation scoring is extremely low, with Gridinsoft assigning a trust score of 0 out of 100, and the domain appears on four known security blocklists. VirusTotal analysis recorded eight detections out of ninety‑three scanning engines, and the domain is actively blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL.

The listed scam type is brand impersonation targeting Discord, although the exact phishing vector (login page, credential harvester, or other) remains unverified. Defenders should continue to block lewwk.net at network perimeter and DNS layers, monitor for any re‑registration or similar payloads using the same IP range, and update endpoint protection signatures to include the observed detection patterns. Ongoing observation is advised to capture any future content changes should the domain be re‑activated.