huddle01[.]vip

Analysis of the domain huddle01.vip indicates an active brand‑impersonation campaign targeting Discord users. The domain was registered on February 21 2026 through NiceNIC International Group Co., Limited and resolves to the IP address 76.76.21.93, which belongs to AS13335 Cloudflare, Inc. in the United States. The site is served behind Cloudflare, utilizes HTTP/3, and currently returns an HTTP 521 status code, suggesting that the origin server is unavailable or refusing connections. SSL is provided by Google Trust Services under the WE1 certificate, confirming a valid TLS handshake despite the underlying malicious intent. Nameserver records point to audrey.ns.cloudflare.com and arnold.ns.cloudflare.com, consistent with the Cloudflare front‑end.

Reputation signals are strongly negative: Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on three independent security blocklists. It is also listed by PhishDestroy, MetaMask, and SEAL as a malicious site. VirusTotal scans report five detections out of ninety‑five security vendors, reinforcing the hostile classification. AlienVault OTX references the domain in a single threat‑intel pulse, indicating that at least one community source has flagged it for observation. The page title observed during scanning is "Home – Huddle01's Documentation," which does not directly reference Discord but aligns with the documented impersonation claim.

Uncertainties remain regarding the exact payload delivered to victims, as the content of the landing page has not been publicly disclosed. Defenders should block the domain at the DNS and proxy layers, monitor outbound traffic to the associated Cloudflare IP range for anomalous connections, and incorporate the domain into URL filtering and endpoint detection rules. Continuous re‑evaluation is advised, as the HTTP 521 response may change if the underlying malicious host becomes active.