discord[.]udeth[.]com

PhishDestroy identifies discord.udeth.com as an active credential theft portal operating under a false Discord login interface. The page is designed to harvest login credentials and session tokens from unsuspecting victims. No drainer kit artifacts are visible in public scans, suggesting the payload may be dynamically served or obfuscated at runtime. The domain leverages a visually similar subdomain to Discord’s official domain (udeth.com), exploiting brand trust to deceive users into entering sensitive credentials. Behavioral analysis indicates real-time credential submission to attacker-controlled servers, confirming active phishing operations. This is a targeted social engineering attack against Discord users, commonly used to hijack accounts for spam, malware distribution, or financial fraud.

Technical indicators confirm elevated risk exposure. This domain was registered on January 14, 2014 via Alibaba Cloud Computing (Beijing) Co., Ltd., and resolves to IP 104.21.3.60. It holds a valid SSL certificate issued by Google Trust Services, increasing trust perception. VirusTotal currently shows 21/95 detections, indicating low signature coverage despite confirmed malicious activity. Google Safe Browsing (GSB) status is under_investigation, and no major blocklist entries are yet published, allowing continued operation. These factors contribute to a high-risk threat profile with low detection visibility.

Current status is active and under investigation. Discord’s security team has not yet blacklisted the domain, and the SSL certificate remains valid, enabling continued operation. Immediate remediation requires DNS-level blocking of IP 104.21.3.60 and domain discord.udeth.com by network administrators and ISPs. Users should avoid accessing the domain entirely and report any accidental credential entry. Remaining risk includes ongoing credential harvesting, account takeovers, and lateral movement within compromised Discord servers. Continuous monitoring and proactive blocking are essential to prevent further exploitation. Response actions must prioritize domain takedown and certificate revocation to neutralize the threat efficiently.