nirvanagun[.]netlify[.]app

This domain, nirvanagun.netlify.app, operates as a high-risk brand impersonation site targeting Discord users. Analysis indicates the page mimics legitimate Discord services under the title 'Nirvana Gun', attempting to harvest user credentials or distribute malicious payloads. The infrastructure is designed to deceive users into believing they are interacting with an official Discord-related application or promotion, increasing the likelihood of successful credential theft or malware delivery. Infrastructure analysis reveals the domain is hosted on Netlify and resolves to IP address 35.157.26.135, located in Germany under AS16509 (Amazon.com, Inc.). The SSL certificate is issued by DigiCert Inc, specifically the DigiCert Global G2 TLS RSA SHA256 2020 CA1. The domain is flagged by 9 out of 95 security vendors on VirusTotal, appears on one security blocklist, and is blocked by at least one threat intelligence feed. Google Safe Browsing has also classified this domain as phishing. No legitimate creation date or registration details are publicly available, but the domain remains active as of this report. Users who have visited nirvanagun.netlify.app should immediately revoke any credentials entered on the site and scan their devices for malware. Discord accounts should be secured by enabling multi-factor authentication and reviewing recent account activity for unauthorized access. If financial or sensitive information was disclosed, monitor associated accounts for suspicious transactions. Network administrators are advised to block the domain and its resolving IP address (35.157.26.135) at the perimeter to prevent further exposure. Report the incident to relevant security teams for further investigation and mitigation.