discord[.]rvcsoft[.]net

This domain is flagged for hosting credential harvesting phishing infrastructure targeting users of a widely used communication platform. Analysis indicates the domain, discord.rvcsoft.net, is designed to mimic legitimate login portals to deceive users into submitting account credentials, which are then exfiltrated to attacker-controlled servers. The threat type is classified as elevated due to the domain's direct targeting of authentication workflows and its potential to facilitate unauthorized account access or subsequent malicious activity. Infrastructure analysis reveals the domain was registered through NameSilo, LLC on March 28, 2026, an unusually future-dated creation that may indicate automated or bulk registration practices. It resolves to the IP address 185.40.155.13, a host previously associated with other phishing campaigns. At the time of assessment, the domain is offline, though it was actively blocked by one security blocklist and detected by 4 out of 95 security vendors on VirusTotal. The domain's registration and hosting patterns align with known phishing infrastructure, including the use of subdomains to impersonate trusted services. Mitigation requires immediate action from network administrators and end users. Organizations should implement DNS-based blocking for discord.rvcsoft.net and its resolved IP, 185.40.155.13, to prevent access from corporate networks. Users who may have interacted with the domain should reset credentials for any accounts entered, particularly those associated with the targeted platform, and enable multi-factor authentication where available. Security teams are advised to monitor logs for connections to the domain or IP, as such activity may indicate compromised credentials or ongoing phishing attempts. Proactive measures, including user education on recognizing spoofed login pages and verifying domain authenticity, are critical to reducing the risk of credential theft.