391[.]lol

Analysis of the domain 391.lol, created on March 14, 2026 and currently taken offline, shows a clear pattern of brand impersonation targeting Discord users. The site presented the page title “Phase 2 Distribution,” a phrase commonly used in multi‑stage phishing campaigns. The SSL certificate is classified as grade E7, indicating weak encryption and a lack of proper validation. Technical fingerprinting reveals the use of Cloudflare services, including Cloudflare Browser Insights and HTTP/3, with the domain resolving to IP address 188.114.97.3, which belongs to AS13335 (Cloudflare, Inc.) in the United States. The registrar is NameSilo, LLC, and the authoritative nameservers are isla.ns.cloudflare.com and razvan.ns.cloudflare.com.

Reputation checks show a Gridinsoft trust score of 0 out of 100, and the domain appears on three independent security blocklists. It is also listed as blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis recorded detections from two of ninety‑four security vendors, reinforcing the malicious classification. The identified scam type is “Social Media Phishing,” consistent with the Discord impersonation claim.

While the site is currently offline, the infrastructure components—Cloudflare edge hosting and the low‑trust SSL certificate—could be reused for future phishing attempts. Defenders should continue to block 391.lol at DNS and proxy layers, monitor the associated IP address for re‑registration, and add the domain to internal threat‑intel feeds. Updating detection signatures to flag the “Phase 2 Distribution” title and the specific combination of Cloudflare‑served assets may improve early identification of similar campaigns. Continuous observation of the registrar’s newly created domains is recommended to catch potential clones that reuse the same naming patterns or hosting configuration.