duplicate-disabled-3768.invalid

This domain, www.handofgod.app, is flagged as an active brand-impersonation threat targeting Discord, a widely used communication platform. Analysis indicates the site employs social engineering tactics to deceive users into divulging login credentials, likely through a fraudulent interface mimicking Discord's authentication flow. The page title 'Hand of God' suggests an attempt to create a false sense of authority or urgency, a common tactic in phishing campaigns to lower user vigilance. No explicit drainer kit signatures have been identified, but the infrastructure and behavioral patterns align with credential harvesting operations. Infrastructure analysis reveals several technical indicators of compromise. The domain resolves to the IP address 76.76.21.164, a known Vercel hosting endpoint, which is frequently leveraged by threat actors due to its low-cost, ephemeral hosting capabilities. VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious, a relatively low but non-negligible detection rate that may indicate evasion techniques or recent deployment. The domain is registered through Porkbun LLC, a registrar commonly used for both legitimate and malicious registrations. It appears on one security blocklist, specifically PhishDestroy, and employs HTTP Strict Transport Security (HSTS) alongside external JavaScript resources loaded from jsDelivr, a content delivery network often abused to obfuscate malicious payloads. The domain's creation date is not provided, but the combination of these indicators suggests a deliberately constructed phishing infrastructure. Current status of www.handofgod.app is active, with elevated risk due to its direct targeting of Discord users and the potential for credential theft or account takeover. Response actions should include immediate blocking of the domain and IP address at the network perimeter, as well as user education to recognize brand-impersonation tactics. Despite the low VirusTotal detection rate, the presence on a security blocklist and the use of Vercel hosting warrant proactive mitigation. Remaining risk includes the possibility of the domain being relocated or rebranded under a different name, a common tactic to evade detection. Organizations and users are advised to monitor for similar domains using the seed 'ec62b7' and to implement multi-factor authentication as a compensatory control against credential-based attacks.