og-anoma[.]net

Analysis indicates that the domain og-anoma.net was registered on August 13, 2025 through Hostinger operations, UAB. The authoritative A record resolves to 213.111.154.75, an address announced by AS43641 SOLLUTIUM EU Sp z.o.o. in the Netherlands. The site presented the HTML title “Community — OG Role”, which aligns with the reported brand impersonation of Discord and the classification as a social‑media phishing campaign. Gridinsoft assigned a trust score of 0 / 100, and an SSL certificate labelled R11 was observed, suggesting a low‑trust certificate.

The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal recorded a single positive detection out of ninety‑three scanned vendors, confirming at least one security product has identified malicious behavior. The overall risk level is elevated, and the current operational status is offline, indicating the phishing infrastructure may have been taken down or is temporarily unavailable. Defenders should treat og-anoma.net as a malicious actor targeting Discord users.

Immediate mitigation actions include adding the domain and its resolved IP address to network‑level blocklists, updating email‑security gateways to flag URLs containing the domain, and ensuring endpoint protection solutions are aware of the single VirusTotal detection. Continuous monitoring of the IP 213.111.154.75 for re‑activation is advisable, as threat actors frequently redeploy infrastructure under the same address. Because only one blocklist entry and a single VirusTotal positive are available, additional intelligence gathering—such as reviewing any captured phishing emails or examining traffic logs for requests to the domain—will improve attribution confidence. Until further evidence is collected, the domain should be considered unsafe and blocked in all user‑facing environments.