discord[.]roinujnosde[.]me

PhishDestroy has identified a domain currently assessed at an elevated risk level due to its involvement in generic phishing operations. This threat is specifically designed to mimic Discord login pages, tricking users into divulging their credentials. The domain, which was created on March 28, 2026, and resolved to IP address 188.114.96.3, is now offline but remains a significant concern for security teams monitoring for credential theft.

According to intelligence gathered, this domain was flagged by 1 out of 95 security vendors on VirusTotal, indicating low but notable detection. It appears on one security blocklist and was hosted behind an SSL certificate issued by Google Trust Services with the WE1 configuration. The page title was observed as "Wolf's Den," which may be a reference to the impersonated service or a red herring. The domain's creation date, combined with its rapid takedown, suggests a short-lived but targeted campaign.

To protect against such generic phishing threats, users should always verify the URL before entering credentials, especially for services like Discord. Enabling multi-factor authentication on all accounts adds an extra layer of security. Organizations should block access to newly registered domains and monitor for similar patterns. If credentials were entered on this domain, they should be changed immediately and checked for compromise on other services. PhishDestroy recommends reviewing security logs for any attempts to access this domain and educating users on recognizing phishing indicators.