registrationrayls[.]xyz

This domain, registrationrayls.xyz, is flagged as a brand impersonation threat specifically targeting Discord, a widely used communication platform. Analysis indicates the site mimics Discord's authentication flow, presenting a page titled 'Rayls — Connect Wallet,' which suggests an attempt to deceive users into linking cryptocurrency wallets or entering credentials under false pretenses. The threat type aligns with credential theft and potential crypto asset compromise, leveraging social engineering tactics to exploit trust in the Discord brand. Infrastructure analysis reveals the domain was registered on November 22, 2025, through Unstoppable Domains, a registrar known for decentralized domain services. It resolves to the IP address 5.181.2.8, which may be part of a broader malicious infrastructure. VirusTotal detection metrics show 5 out of 95 security vendors flagging the domain as malicious, indicating moderate but not universal recognition of the threat. The domain appears on a single blocklist, specifically PhishDestroy, and no Google Safe Browsing (GSB) records were identified at the time of analysis. The domain is currently offline, reducing immediate exposure to end users. However, the elevated risk level persists due to the potential for the infrastructure to be reactivated or repurposed. Response actions should include monitoring for re-registration or DNS changes, as well as proactive blocking of the IP address 5.181.2.8 in network security controls. Organizations and users are advised to verify domain authenticity before entering credentials or connecting wallets, particularly when prompted by unsolicited links or third-party services claiming affiliation with Discord.