dsicrod[.]com

This domain is flagged as a high-risk credential theft operation targeting Discord users. Analysis indicates the site impersonates the Discord platform to harvest login credentials, enabling unauthorized access to user accounts, private servers, and sensitive communications. The threat extends to potential secondary attacks, including malware distribution or social engineering campaigns leveraging compromised accounts. Infrastructure analysis reveals the domain dsicrod.com was registered on March 26, 2021, through Media Elite Holdings Limited. It resolves to the IP address 34.160.121.137, hosted on Google Cloud infrastructure with Node.js and Express technologies detected. The domain is associated with a Let's Encrypt SSL certificate and appears on three security blocklists: PhishDestroy, DiscordPhishing, and OISD. It has been flagged by 13 out of 95 security vendors on VirusTotal and is referenced in six threat intelligence pulses on AlienVault OTX. The Gridinsoft trust score for this domain is 0/100, further confirming its malicious nature. The page title explicitly mimics Discord, reinforcing its credential theft objective. Organizations and users are advised to implement the following mitigation measures to counter this credential theft threat. First, block the domain dsicrod.com and its associated IP address 34.160.121.137 at the network perimeter using firewalls or DNS filtering solutions. Second, deploy endpoint protection rules to prevent access to the domain and alert on any attempts to visit it. Third, enable multi-factor authentication (MFA) on all Discord accounts to reduce the impact of credential theft. Fourth, conduct user awareness training to educate individuals on recognizing phishing attempts, particularly those impersonating Discord. Fifth, monitor network logs for connections to the domain or IP address and investigate any suspicious activity. Finally, report the domain to relevant threat intelligence platforms to contribute to collective defense efforts.