confirm[.]invitetracker[.]cc

This domain, confirm.invitetracker.cc, is flagged as a high-risk phishing site targeting Discord users through a fraudulent 'Invite Tracker' interface. Analysis indicates the threat type is credential and token theft, likely designed to mimic legitimate Discord bot services to deceive victims into entering login credentials or authorizing malicious OAuth applications. No specific drainer kit signatures were identified, but the page title 'Invite Tracker' suggests an attempt to impersonate a popular Discord utility service. Infrastructure analysis reveals the domain was registered on June 15, 2026, through Dynadot Inc., and currently resolves to IP address 172.67.160.145 (AS13335, Cloudflare, Inc.). The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of phishing sites leveraging free certificates to appear legitimate. VirusTotal detection shows 4 out of 95 security vendors have flagged this domain, while it appears on one security blocklist. The domain remains unlisted in Google Safe Browsing at the time of analysis. The site remains active and continues to pose a significant risk to users who may encounter it through Discord invite links or social engineering campaigns. Response actions should include immediate blocking of the domain and IP at the network perimeter, as well as monitoring for related indicators of compromise, such as unusual OAuth token requests or credential stuffing attempts. Users are advised to revoke any suspicious Discord authorizations and enable multi-factor authentication to mitigate potential account takeovers. The remaining risk is high due to the domain's active status and low detection rate among security vendors.