xn--dscordapp-vpb[.]com

Analysis of xn--dscordapp-vpb.com shows it was registered on 21 February 2026 through GoDaddy.com, LLC and is served by the authoritative name servers ns47.domaincontrol.com and ns48.domaincontrol.com. DNS resolution points to 162.159.135.232, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The site presents the page title “Discord – Group Chat That’s All Fun” and is classified as an investment‑scam impersonating Discord, although the exact content of the landing page has not been captured because the host is currently offline. The TLS certificate is issued by Go Daddy Secure Certificate Authority – G2 and is signed by GoDaddy.com, Inc., matching the registrar information.

Threat intelligence exposure includes appearance in 13 AlienVault OTX pulses, inclusion on one external security blocklist, and active blocking by the PhishDestroy feed. Gridinsoft assigns a trust score of 0 / 100, indicating a high likelihood of malicious intent. VirusTotal analysis reports nine of ninety‑three scanning engines flagging the domain, reinforcing the suspicion. Detected third‑party components comprise Apple iCloud Mail, YouTube, Google Cloud, Zendesk, Sendgrid, OneTrust, jQuery and hCaptcha, a typical stack for credential‑harvesting or phishing infrastructures.

No further artefacts such as malicious payloads or command‑and‑control endpoints have been observed. Uncertainty remains around the specific phishing workflow and whether the site ever served a functional login form before being taken down. Defenders should add the domain to blocklists, enforce DNS sink‑hole policies for 162.159.135.232, monitor for any future resolution changes, and correlate any outbound traffic to the listed third‑party services with user authentication events. Continuous re‑query of VirusTotal and OTX for new detections is recommended, as is verification of any related email campaigns that may leverage the same Sendgrid or Apple iCloud Mail identifiers.