loopsccale[.]com

Analysis of loopsccale.com, created on February 22 2026 and registered through NiceNIC International Group Co., Limited, shows a high‑risk brand‑impersonation campaign targeting Discord users. The domain resolves to 104.21.89.24, an address owned by AS13335 Cloudflare, Inc. in the United States, and is served behind Cloudflare’s edge network with HSTS and HTTP/3 enabled. An HTTP 301 response indicates the site redirects rather than delivering content directly, and the TLS certificate is issued by Let’s Encrypt under the identifier E7, confirming the presence of standard HTTPS encryption. The page title returned by the server is "Loopscale," which does not reference the Discord brand, and no additional page content has been publicly disclosed, leaving the visual or functional aspects of the impersonation unverified.

VirusTotal scans show that 3 of 95 security vendors have flagged the domain as malicious, providing limited but concrete vendor‑level detection. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the consensus that the site is being used for malicious purposes. Gridinsoft assigns a trust score of 0 out of 100, indicating a complete lack of trustworthiness. The infrastructure footprint, including the Cloudflare IP, the use of a free Let’s Encrypt certificate, and the minimal detection coverage, suggests a low‑cost, quickly provisioned phishing kit rather than a sophisticated, persistent operation.

Defenders should add loopsccale.com to URL filtering and DNS blocklists, monitor for similar domains registered with the same registrar or using the same nameservers (kyree.ns.cloudflare.com, tia.ns.cloudflare.com), and enforce strict verification of Discord login URLs in user communications. Organizations should also consider sharing indicators of compromise, such as the domain name, IP address, and SSL fingerprint, with threat‑intelligence platforms to improve collective detection.