braavos[.]store

The domain braavos.store was created on July 14, 2025 and is currently listed as taken offline. It resolves to the IP address 216.150.1.1, which belongs to the Amazon.com, Inc. network (AS16509) and is geolocated in the United States. No SSL certificate was observed for the host, meaning traffic is unencrypted and vulnerable to interception. The page title returned by the HTTP service is "Download Braavos Wallet App - BraavosBraavos," suggesting a focus on a cryptocurrency wallet. The site is classified as a crypto scam and explicitly impersonates the Discord brand, as indicated by the threat intelligence tag "Impersonates: discord." Registration details show the domain was acquired through HOSTINGER operations, UAB, and the domain appears on a single security blocklist.

PhishDestroy has recorded the domain as blocked, reinforcing the malicious assessment. Detection services on VirusTotal reported that one out of ninety‑five security vendors flagged the domain, providing a minimal but present indication of malicious activity. Independent scoring from Gridinsoft assigned a trust score of 0 out of 100, reflecting the highest confidence of abuse. The domain utilizes a single nameserver, though the specific nameserver identifier is not disclosed in the available data.

While the exact content of the landing page has not been analyzed, the combination of brand impersonation, crypto‑wallet terminology, lack of TLS, and low trust metrics suggests a high probability of credential harvesting or financial fraud targeting Discord users. Defensive actions should include adding braavos.store to deny‑list rules on web filters, updating intrusion‑prevention signatures to block traffic to the IP 216.150.1.1, and monitoring for any outbound connections from internal hosts to the domain. Security teams should also advise users to avoid downloading applications from this URL and to verify official Discord communications through known channels.