mjapi[.]himj[.]cc

The domain mjapi.himj.cc has been identified as a confirmed brand impersonation site targeting Discord. The domain is currently offline, reducing immediate risk to potential victims but remains a point of concern due to its past activity and the nature of the threat it posed.

Infrastructure analysis reveals that the domain was registered through Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn) and created on November 27, 2023. It resolved to the IP address 8.217.38.69, which is located in Hong Kong and is part of the AS45102 Alibaba (US) Technology Co., Ltd. network. The site was flagged by 16 out of 95 security vendors on VirusTotal, indicating a significant level of suspicion among the security community. Additionally, the domain appears on two security blocklists, specifically PhishDestroy and PhishingDB, further corroborating its malicious intent. The SSL certificate was issued by Let's Encrypt, which is a common practice among phishing sites to gain a superficial level of trust.

Currently, the domain is offline, but it is recommended that organizations and individuals continue to monitor for any signs of reactivation. Security teams should update their threat intelligence databases and ensure that network defenses are configured to block this domain if it becomes active again. Users should be educated to recognize and avoid suspicious links, especially those that purport to be from trusted brands like Discord. Regular security awareness training and the use of multi-factor authentication can help mitigate the risk of falling victim to similar brand impersonation attacks.