resolv-tge[.]xyz

This domain, resolv-tge.xyz, poses a brand impersonation threat specifically targeting Discord users through a fraudulent claim portal. The site is designed to mimic legitimate Discord reward or token distribution pages, likely to harvest user credentials, session tokens, or deploy malicious payloads under the guise of a "Resolv Claim" offer. The infrastructure and page title suggest an attempt to exploit users expecting airdrops, NFT mints, or other promotional events associated with Discord communities, which are common vectors for credential theft and account compromise. Analysis indicates the domain was registered on June 02, 2025, through Web Commerce Communications Limited. It resolves to the IP address 104.21.58.238 and has been flagged by 5 out of 95 security vendors on VirusTotal. The domain appears on five security blocklists, including entries from Polkadot, Codeesura, PhishDestroy, ScamSniffer, and Enkrypt. The combination of recent registration, low detection rates, and blocklist presence suggests an active but relatively new campaign with limited exposure thus far. Users who visited resolv-tge.xyz should immediately revoke any active sessions linked to Discord or associated third-party applications. Reset passwords using a secure, non-compromised device and enable multi-factor authentication if not already active. Monitor accounts for unauthorized activity, including message history, connected apps, and linked payment methods. If credentials were entered, assume they are compromised and avoid reusing them across other platforms. Check browser extensions and installed applications for unfamiliar or suspicious additions, as some campaigns deploy malware to maintain persistence. Report the incident to the targeted platform's security team for further investigation and potential account recovery assistance.