discord[.]power-riders[.]de

This domain, discord.power-riders.de, is flagged as an active phishing site targeting users of the Discord platform. Registered on March 28, 2026, the domain presents a page titled 'Discord,' suggesting an attempt to replicate the legitimate Discord login interface. Infrastructure analysis reveals the domain resolves to the IP address 85.13.129.78, hosted by Neue Medien Muennich GmbH in Germany. The site employs a Let's Encrypt SSL certificate issued under the R13 intermediate, which is commonly used by both legitimate and malicious sites to enable HTTPS connections. The domain is currently listed on one security blocklist, specifically PhishDestroy, and has been assigned a trust score of 0/100 by Gridinsoft, indicating a high level of suspicion. A VirusTotal scan reports that 4 out of 95 security vendors have flagged the domain as malicious, providing further evidence of its involvement in phishing activity. The site returns an HTTP 301 redirect status, which may be used to forward victims to another malicious page or to obscure the final destination of the phishing attempt. While the exact phishing kit or campaign associated with this domain remains unclear, the combination of its recent registration, Discord-themed page title, and security vendor detections strongly suggests it is part of an active credential harvesting operation. Defenders should treat this domain as high-risk and prioritize blocking access to it within their networks. Monitoring for additional domains hosted on the same IP address or using similar SSL certificates may help identify related phishing infrastructure. Given the domain's active status as of July 12, 2026, organizations should also review logs for any connections to this domain or its associated IP address to assess potential exposure.