discord-cn[.]com[.]cn

PhishDestroy’s automated threat-intelligence pipeline has flagged discord-cn.com.cn as an active phishing domain posing as the official Chinese-language Discord site. The page (title: Discord - 让沟通更简单 | 官方指南与下载) lures victims by promising simplified Chinese downloads and support links, but ultimately harvests Discord account credentials and session tokens. Technical telemetry confirms the domain resolves to a Cloudflare-anycast IP (188.114.96.3), hosts a Let’s Encrypt SSL certificate, and is currently unblocked by most endpoint security stacks despite zero detections on VirusTotal at the time of discovery (3/95 engines). Google Safe Browsing already classifies the page under the SOCIAL_ENGINEERING category, indicating confirmed deception. This domain was registered on March 9, 2025 through Web Commerce Communications Limited (ENOM reseller), giving attackers an 8-month window to exploit brand trust before detection. The rapid domain creation coupled with the low detection rate (3/95) and active status suggests a coordinated campaign targeting Chinese-speaking Discord users who may overlook subtle URL differences. The presence of an official-looking Chinese interface increases the likelihood of successful credential theft, particularly among users seeking localized support or installation packages. If you visited discord-cn.com.cn or downloaded any file from it, immediately revoke the affected Discord token via the official Security settings page (discord.com/settings/security), change your password using a password manager, and enable two-factor authentication with a hardware key or authenticator app. Scan all connected devices with a reputable antivirus suite for infostealer artifacts, and report the domain to Discord’s Trust & Safety team through their abuse portal. Bookmark official download links (discord.com/download) to avoid typosquat variants and always verify URLs before entering credentials.