discord[.]mefriendos[.]de

This domain, discord.mefriendos.de, is actively serving a phishing page designed to mimic the Discord login interface. Analysis indicates the site was registered on March 29, 2026, and currently resolves to IP address 152.89.239.50, hosted under Bieber IT GmbH in Germany. The domain has been assigned a trust score of 0/100, reflecting its confirmed malicious status, and is flagged by one security blocklist. A 301 HTTP redirect is in place, which may be used to funnel victims toward credential harvesting pages or malware distribution endpoints. The page title 'MeFriendos' suggests an attempt to impersonate a legitimate service, likely targeting users of the Discord platform. The SSL certificate is issued by Let's Encrypt, a common tactic among threat actors to create a false sense of security for visitors. While only one out of 95 security vendors on VirusTotal currently flags this domain, this low detection rate does not indicate safety—rather, it may reflect the site's recent deployment or evasion techniques. The infrastructure appears to be purpose-built for phishing, with no legitimate use case observed. Defenders should treat this domain as high-risk and prioritize blocking it at the network level. The IP address 152.89.239.50 should be monitored for additional malicious domains, as shared hosting environments are frequently reused for phishing campaigns. Organizations are advised to inspect logs for connections to this domain, particularly from endpoints where Discord or similar communication platforms are in use. If credentials were entered on this site, immediate password resets and multi-factor authentication enforcement are recommended for affected accounts. Given the domain's recent registration and active status, further evolution of its infrastructure or payload delivery methods is likely.