guardian[.]discord-access[.]com

PhishDestroy identifies guardian.discord-access.com as a confirmed phishing domain distributing a crypto drainer kit designed to impersonate Discord’s official access portal. The domain leverages a spoofed login interface to harvest user credentials and crypto wallet data. Security research suggests this is part of a broader campaign targeting Discord communities, where attackers embed malicious links in messages or fake invites to redirect users to the fraudulent landing page. Unlike generic phishing pages, this domain appears to be part of an automated kit optimized for credential harvesting and automated fund transfers from connected wallets.

This domain was flagged as a generic phishing domain with high-fidelity indicators including a VirusTotal detection score of 14/95, indicating it remains undetected by most antivirus engines. The domain was registered on April 10, 2026 through the registrar Fewmoretaps OU under the trade name Trustname.com. It resolves to IP address 188.114.96.3, a known hosting provider within Cloudflare’s IP range. The SSL certificate is issued by Let’s Encrypt, which is commonly exploited to add legitimacy to fraudulent sites. As of this report, the domain is not flagged in Google Safe Browsing (GSB) and has not been added to major blocklists, increasing exposure to potential victims despite low detection rates.

The domain status remains active and under investigation, with no takedown actions observed as of report generation. Security researchers are monitoring for associated drainer kit components, such as wallet drainer scripts or Discord OAuth phishing modules. Users are advised to verify any Discord access links using PhishDestroy’s real-time scanning tool and avoid entering credentials on unfamiliar domains. While the immediate risk is elevated due to low detection and active resolution, the lack of takedown suggests potential delay in mitigation. Users should also inspect browser extensions and connected wallet permissions for signs of compromise if they previously interacted with this domain.