0glabs[.]network-app[.]cloud

This domain, 0glabs.network-app.cloud, was registered through Web Commerce Communications Ltd. on July 25 2025. The site resolves to the Cloudflare‑owned address 172.67.161.163, ASN 13335, located in the United States. The TLS certificate presented is identified as WE1, which does not correspond to a trusted brand authority. The page title returned from the HTTP response is “Mainnet | 0G”, offering no direct reference to the targeted brand. However, threat intelligence flags the domain as a Discord impersonation used for social‑media phishing.

The indicator set includes a listing on a single security blocklist and a block by PhishDestroy. VirusTotal analysis shows that 7 of 93 scanning engines have raised detections, confirming malicious behavior. Gridinsoft assigns a trust score of 0 out of 100, indicating a high likelihood of abuse. The domain is currently taken offline, which limits immediate exposure but does not remove the risk of future reactivation. Analysis of the available artifacts indicates a classic credential‑harvesting infrastructure that leverages reputable cloud hosting to hide behind legitimate IP ranges.

The lack of additional public blocklist listings or broader vendor consensus suggests limited dissemination, yet the presence of multiple detections demonstrates that at least some security products have identified malicious activity. Defenders should continue to monitor DNS queries for the host name, enforce URL filtering that blocks the domain, and consider adding the address to internal blocklists. Further investigation of the TLS certificate and any associated subdomains is recommended to determine whether the same infrastructure is being reused for other brand‑targeted campaigns. Until the domain is definitively retired, organizations protecting Discord users should treat any traffic to this host as hostile.