invisibledefi[.]com

Analysis indicates that the domain invisibledefi.com is currently offline but exhibits multiple indicators consistent with a brand‑impersonation campaign targeting Discord users. The domain was registered on August 29 2025 through Spaceship, Inc., and resolves to the IPv4 address 66.29.148.111, which is assigned to AS22612 operated by Namecheap, Inc. in the United States. The authoritative nameservers are launch1.spaceship.net and launch2.spaceship.net, both typical of the registrar’s default configuration. The only visible page title retrieved from historical scans reads “InvisibleDeFi – DeFi agentúra”, suggesting a possible attempt to masquerade as a decentralized‑finance service, yet the declared scam type in intelligence is “Crypto Scam”. No TLS certificate is presented for the host, meaning any traffic would be unencrypted if the site were reachable.

Threat intelligence sources flag the domain on one security blocklist and record a single pulse on the AlienVault OTX platform, indicating limited but concrete community awareness. VirusTotal analysis shows that one out of ninety‑five scanning engines flagged the domain, and the Gridinsoft trust score is 0 / 100, reinforcing the malicious assessment. PhishDestroy has listed the domain as blocked, further confirming its use in abusive activity. The branding reference specifies impersonation of Discord, although the page title does not contain Discord branding. This discrepancy suggests that the malicious infrastructure may have been intended to host a Discord‑related credential‑harvesting page that is no longer accessible.

Because the site is offline, direct content verification is not possible, and the exact phishing kit or payload remains unknown. Defenders are advised to continue blocking the host at the network perimeter, incorporate the IP address 66.29.148.111 and the associated nameservers into threat‑intel feeds, and monitor for newly registered domains using the same registrar or similar naming patterns.