ldiscord[.]vercel[.]app

This domain ldiscord.vercel.app is currently offline but exhibits multiple indicators of a brand‑impersonation campaign targeting Discord users. DNS resolution points to the address 64.29.17.67, which belongs to the Amazon.com, Inc. network (AS16509) and is geolocated in the United States. The site was hosted on Vercel infrastructure, as reflected by the detected Vercel platform and the presence of HTTP Strict Transport Security (HSTS) headers. The TLS certificate issued by Google Trust Services bears the WR1 designation, confirming that the connection was protected by a legitimate certificate chain, a common tactic used to increase victim confidence.

Google Safe Browsing has classified the URL as a social‑engineering threat, and VirusTotal records show that 16 of 95 scanning engines flagged the domain for malicious behavior. The page title returned by the server is simply “Discord,” matching the declared brand target. The domain was registered through Vercel Inc., and no authoritative name servers could be identified (NS_NOT_FOUND). An HTTP 451 response was observed, indicating that the content was unavailable for legal reasons, which is consistent with takedown or blocklist action.

The site appears on at least one public security blocklist and has been actively blocked by the PhishDestroy service. Although the site is presently offline, the combination of a high‑risk rating, confirmed hosting on a major cloud provider, a valid SSL certificate, and multiple vendor detections suggests a well‑crafted phishing infrastructure. Defenders should continue to monitor DNS queries for 64.29.17.67, update email and web filtering rules to block the domain, and consider sharing the indicator set with threat‑sharing platforms. Further analysis is limited by the lack of visible page content and missing name‑server information, so any future re‑hosting of the domain should be treated as high‑confidence malicious activity.