ygmi[.]webflow[.]io

The domain ygmi.webflow.io was identified as a brand impersonation phishing threat specifically targeting Discord users. The domain is currently offline, having been taken down after being flagged for malicious activity. The page title, "YGMI: Web3 Jobs, NFT Artists, Developers, Remote," was used to lure victims interested in cryptocurrency and remote work opportunities.

Investigation revealed that ygmi.webflow.io was flagged by 12 out of 95 VirusTotal security vendors, indicating a high level of consensus on its malicious nature. The domain was registered through MarkMonitor, Inc. and resolved to IP address 172.64.151.8. Its SSL certificate was issued by Google Trust Services (WE1). The domain was created on May 08, 2013, which is relatively old, but it was repurposed for phishing. Google Safe Browsing flagged the domain as phishing, and it appears on one security blocklist. Despite the low blocklist count, the VirusTotal detection rate and Safe Browsing flag confirm the threat.

Given its current offline status, users are no longer at immediate risk from this domain. However, PhishDestroy recommends that users avoid visiting any similar domains impersonating Discord or other trusted brands. Always verify URLs before entering credentials or personal information. If you have already interacted with this domain, change your Discord password immediately and enable two-factor authentication. Report any suspicious domains to security teams or phishing reporting services.