getdiscount[.]vip

This domain, getdiscount.vip, is identified as a credential theft phishing infrastructure designed to harvest login credentials through deceptive offers and fraudulent login portals. Analysis indicates the domain was structured to mimic legitimate discount or promotional services, tricking users into entering sensitive account details under false pretenses. The threat primarily targets individuals seeking financial incentives, leveraging social engineering tactics to bypass initial user skepticism. Evidence supporting this assessment includes detection by 19 out of 95 security vendors on VirusTotal, indicating broad consensus on its malicious nature. The domain was registered on February 21, 2026, through Gname.com Pte. Ltd., and resolved to the IP address 47.77.216.153, hosted under AS45102 (Alibaba (US) Technology Co., Ltd.). It appears on one security blocklist, and its SSL certificate was issued under the identifier PhishDestroy / botadmin.destroy.tools, further linking it to known phishing toolkits. The domain has since been taken offline, but residual risk remains for users who may have interacted with it prior to deactivation. Users who visited getdiscount.vip or entered credentials on any associated pages should immediately reset passwords for all accounts accessed from the same device or network. Enable multi-factor authentication (MFA) where available to mitigate unauthorized access. Monitor financial and personal accounts for suspicious activity, as stolen credentials may be used in follow-up attacks. If the domain was accessed via a corporate or shared device, notify the relevant IT or security team to conduct a forensic review. Exercise caution with unsolicited promotional links, particularly those offering unrealistic discounts or requiring immediate login.