landing-page-d72[.]pages[.]dev

The domain landing-page-d72.pages.dev has been identified as a brand impersonation threat targeting Discord users. Analysis confirms the domain was actively spoofing Discord’s official interface to deceive visitors into engaging with malicious connectivity prompts, likely intended for credential harvesting or unauthorized transaction approvals. The domain is currently offline, though prior activity aligns with patterns observed in crypto-drainer or session-hijacking campaigns. Infrastructure analysis reveals the domain was registered on September 13, 2024, through Cloudflare, Inc., and resolved to the IP address 172.66.47.9, hosted under Cloudflare’s AS13335. The SSL certificate, issued by Google Trust Services (WE1), provided a false sense of legitimacy. Security vendors flagged the domain in 18 of 95 VirusTotal scans, while two independent blocklists—PhishDestroy and PhishingDB—listed it as malicious. The page title, "WalletConnect: The Connectivity Layer for the Financial Internet — WalletConnect," further indicates an attempt to mimic cryptocurrency-related authentication flows, a common tactic in Discord-targeted fraud. Current status confirms the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Organizations and individuals are advised to monitor for unauthorized access to Discord accounts or linked wallets, particularly if credentials were entered during the exposure window. Network-level protections should be updated to include the domain and associated IP in deny lists. Users who encountered the page are urged to revoke active sessions, rotate passwords, and enable multi-factor authentication where available. Proactive threat hunting for related indicators—such as the domain’s creation date, registrar, or IP—can help identify connected infrastructure in future campaigns.