chatgpt0005.eu.org
172.67.192.219  Malicious Activity! Public Scan Open in urlscan Pro

Internal
urlscan.io (IP) urlscan.io (Domain)
Effective Hostname
VirusTotal SecurityTrails crt.sh
Submitted URL
Google Safe Browsing Archive.org
Effective IP
VirusTotal SecurityTrails Domaintools Censys
Go To Rescan
Add Verdict Report
URL:
https://chatgpt0005.eu.org/blog/discord-orbs 3yr old
Submission: On September 02 via api (September 2nd 2026, 8:52:20 am UTC) from US — Scanned from DE Go Pro

Only in urlscan Pro

  • Select different country locations for Private Scans.
  • Use a global network of additional scanning locations and residential IPs for scanning.
  • Interact with pages while you are scanning them.
  • Download files from remote websites.
  • Scan websites on the Tor Network.
Click for more information
Free trials of urlscan Pro are available.
Summary HTTP 5 Redirects Links 2  Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 5 HTTP transactions. The main IP is 172.67.192.219, located in Ascension Island and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is chatgpt0005.eu.org. 3yr old
TLS certificate: Issued by YE1 on August 21st 2026. Valid for: 3mo.
This is the only time chatgpt0005.eu.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Cloudflare (Online)

Domain & IP information

IP Address AS Autonomous System
4 172.67.192.219 172.67.192.219 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 2 104.18.94.41 104.18.94.41 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
5 2
Apex Domain
Subdomains		 Transfer
4 eu.org
chatgpt0005.eu.org 3yr old
23 KB
2 cloudflare.com 1 redirects
challenges.cloudflare.com — Cisco Umbrella Rank: 1131 5yr old
27 KB
5 2
Domain Requested by
4 chatgpt0005.eu.org chatgpt0005.eu.org
2 challenges.cloudflare.com 1 redirects chatgpt0005.eu.org
5 2

This site contains links to these domains. Also see Links.

Domain
www.cloudflare.com
Subject Issuer Validity Valid
chatgpt0005.eu.org
YE1		 2026-08-21 -
2026-11-19		 3mo crt.sh

This page contains 1 frames:

Primary Page: https://chatgpt0005.eu.org/blog/discord-orbs
Frame ID: A56DADA10C9132A5EEA58F2DC4AD4E4E
Requests: 5 HTTP requests in this frame

Screenshot Go Pro

Only in urlscan Pro

Use the Visual Search feature to find pages with visually similar screenshots.
Click for more information
Free trials of urlscan Pro are available.
Full Image

Page Title

Suspected Phishing | Cloudflare

Page Statistics

5
Requests

80 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

49 kB
Transfer

154 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • https://challenges.cloudflare.com/turnstile/v0/api.js HTTP 302
  • https://challenges.cloudflare.com/turnstile/v0/b/e694063b5082/api.js

5 HTTP transactions Go Pro

Only in urlscan Pro

Inspect WebSocket connections, examine POST data effortlessly, and track overlap counts in real time. Features live search and filtering across all HTTP output, complete with full response metadata for deep analysis.
Click for more information
Free trials of urlscan Pro are available.
0 data transactions

Method
Protocol		 Status Resource
Path		 Size
x-fer		 Time
Latency		 Type
MIME-Type		 IP
Location
GET
H3 		403
 Primary Request discord-orbs Show response
chatgpt0005.eu.org/blog/ 		4 KB
2 KB 		69ms
13ms 		Document
text/html		 172.67.192.219
Cloudflare
General
Check archive.org
Download Go to
Full URL
https://chatgpt0005.eu.org/blog/discord-orbs
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.192.219 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4071092b2dccd600084404328ed4c593263b8942ab536a8f423b6c4190314286
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
a34b472b4c31dbcd-FRA
content-encoding
zstd
content-type
text/html; charset=utf-8
date
Wed, 02 Sep 2026 08:52:20 GMT
expires
Thu, 01 Jan 1970 00:00:01 GMT
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
referrer-policy
same-origin
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=mXdlfsOPTxiQTSg49xatD37aXd2QRmtkbOvnoA9Rtu9SgM593s%2FGQGweup3IfCuXNtcD9gbaBulRBiKmBk9JhVow3U4%2Bwd7KAVuMT509z74suDx%2FPTcAJ0NoHNYkQwA1r7wHZ4U%3D"}]}
server
cloudflare
x-frame-options
SAMEORIGIN
GET
H3 		200
 cf.errors.css
chatgpt0005.eu.org/cdn-cgi/styles/ 		23 KB
5 KB 		9ms
8ms 		Stylesheet
text/css		 172.67.192.219
Cloudflare
General
Check archive.org
Download Go to
Full URL
https://chatgpt0005.eu.org/cdn-cgi/styles/cf.errors.css
Requested by
Host: chatgpt0005.eu.org
URL: https://chatgpt0005.eu.org/blog/discord-orbs
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.192.219 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://chatgpt0005.eu.org/blog/discord-orbs
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cf-ray
a34b472b6c33dbcd-FRA
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding
zstd
date
Wed, 02 Sep 2026 08:52:20 GMT
content-type
text/css
server
cloudflare
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=RJseUEOufi9IWX7FNVOznUTWHZnjh4WSqwu1TrKsOvYggvDMyryc57qvC4ArtellHXkza2NldMHlWWCJLbtLegP%2BQ6cBVGAKYYD0GqfL6yq7%2BLN6qBjbK9GL1uW9c85aONGpcWQ%3D"}]}
GET
H3 		200
 api.js Show response
challenges.cloudflare.com/turnstile/v0/b/e694063b5082/
Redirect Chain
  • https://challenges.cloudflare.com/turnstile/v0/api.js
  • https://challenges.cloudflare.com/turnstile/v0/b/e694063b5082/api.js
82 KB
27 KB 		19ms
19ms 		Script
application/javascript		 104.18.94.41
Cloudflare
General
Check archive.org
Download Go to
Full URL
https://challenges.cloudflare.com/turnstile/v0/b/e694063b5082/api.js
Requested by
Host: chatgpt0005.eu.org
URL: https://chatgpt0005.eu.org/blog/discord-orbs
Protocol
H3
Server
104.18.94.41 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6212b8bf7b8f35f64734136a82e50f1e6e28c9579a95e5333ff4913efcac5154
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Referer

Response headers

cache-control
max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public
content-encoding
br
etag
W/"e694063b5082-api"
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
cf-ray
a34b472b9992d2f7-FRA
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 02 Sep 2026 08:52:20 GMT
content-type
application/javascript; charset=UTF-8
server
cloudflare
priority
u=3,i=?0

Redirect headers

cache-control
max-age=300, stale-if-error=10800, stale-while-revalidate=300, public
location
/turnstile/v0/b/e694063b5082/api.js
cross-origin-resource-policy
cross-origin
cf-ray
a34b472b8940d2f7-FRA
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
0
server-timing
cfExtPri
date
Wed, 02 Sep 2026 08:52:20 GMT
server
cloudflare
priority
u=3,i=?0
GET
H3 		200
 icon-exclamation.png
chatgpt0005.eu.org/cdn-cgi/images/ 		452 B
799 B 		8ms
8ms 		Image
image/png		 172.67.192.219
Cloudflare
General
Check archive.org
Download Go to Show image
Full URL
https://chatgpt0005.eu.org/cdn-cgi/images/icon-exclamation.png?1376755637
Requested by
Host: chatgpt0005.eu.org
URL: https://chatgpt0005.eu.org/cdn-cgi/styles/cf.errors.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.192.219 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://chatgpt0005.eu.org/cdn-cgi/styles/cf.errors.css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cf-ray
a34b472b8c34dbcd-FRA
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-length
452
date
Wed, 02 Sep 2026 08:52:20 GMT
content-type
image/png
server
cloudflare
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=98iCs5wp0yNnJ4xiE0bzYj6FRCx%2BdoOF5dxUVmaftnm%2BpeWLi%2FFm4rKjTq0O%2BxnKQBPYRm6Vq4Zp2hdOytGcaJftQAR88neC9z3Zqj%2FF%2FCkrsEdvby6pwUJ2%2BOp0NMQ13%2B6187I%3D"}]}
GET
H3 		404
 favicon.ico
chatgpt0005.eu.org/ 		44 KB
14 KB 		194ms
194ms 		Other
text/html		 172.67.192.219
Cloudflare
General
Check archive.org
Download Go to
Full URL
https://chatgpt0005.eu.org/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.192.219 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
387415ef8bdf8e36fc6b232bd8584295f1ba6e14399518dc2ef6798cc3f898af
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'nonce-MTc4LDIyLDcwLDIxMiw4NiwyOSwxMzksMTcz' https://discord.com https://www.googletagmanager.com https://connect.facebook.net https://www.google-analytics.com https://ssl.google-analytics.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/ https://hcaptcha.com https://*.hcaptcha.com https://challenges.cloudflare.com https://s.ytimg.com/yts/jsbin/ https://www.youtube.com/iframe_api https://www.youtube.com/s/player/ https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://*.hcaptcha.com https://hcaptcha.com; img-src 'self' https://www.google-analytics.com https://www.googletagmanager.com https://www.facebook.com https://cdn.discordapp.com https://safety.discord.com https://discordmoderatoracademy.zendesk.com https://assets-global.website-files.com data:; font-src 'self' https://fonts.gstatic.com; connect-src 'self' https://discordapp.com https://discord.com https://connect.facebook.net https://api.greenhouse.io https://api.github.com https://*.sentry.io https://www.google-analytics.com https://*.hcaptcha.com https://hcaptcha.com https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location ws://127.0.0.1:* http://127.0.0.1:*; media-src 'self' https://cdn.discordapp.com/assets/ https://cdn.discordapp.com/promotions/premium-marketing/; frame-src https://discordapp.com/domain-migration https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/ https://*.hcaptcha.com https://hcaptcha.com https://challenges.cloudflare.com https://www.youtube.com/embed/ https://10851314.fls.doubleclick.net/;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://chatgpt0005.eu.org/blog/discord-orbs
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
zstd
cf-cache-status
HIT
etag
W/"6edd7a9c82d683847cb4a89deec46fd4"
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=BJSr%2F%2Bg%2FwlZRYEdZY2beboinRJS65FRTutcPv8stDcZ4sLqUPOPNKiRK1GUHY4wWOaWUxbfbaRxu%2FWopO8UctOfF7FnLg%2BA4ppc6lOhr3O773hO9d%2FhUTLO%2FijQN1XjRi7t%2Fbic3cQd2"}]}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-build-id
2213ba75fb529dbbdd2112144a7beb3e793746db
date
Wed, 02 Sep 2026 08:52:20 GMT
content-type
text/html
last-modified
Thu, 20 Aug 2026 16:54:31 GMT
priority
u=1,i
x-frame-options
DENY
strict-transport-security
max-age=31536000; includeSubDomains; preload
reporting-endpoints
csp-sentry="https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable"
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'nonce-MTc4LDIyLDcwLDIxMiw4NiwyOSwxMzksMTcz' https://discord.com https://www.googletagmanager.com https://connect.facebook.net https://www.google-analytics.com https://ssl.google-analytics.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/ https://hcaptcha.com https://*.hcaptcha.com https://challenges.cloudflare.com https://s.ytimg.com/yts/jsbin/ https://www.youtube.com/iframe_api https://www.youtube.com/s/player/ https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://*.hcaptcha.com https://hcaptcha.com; img-src 'self' https://www.google-analytics.com https://www.googletagmanager.com https://www.facebook.com https://cdn.discordapp.com https://safety.discord.com https://discordmoderatoracademy.zendesk.com https://assets-global.website-files.com data:; font-src 'self' https://fonts.gstatic.com; connect-src 'self' https://discordapp.com https://discord.com https://connect.facebook.net https://api.greenhouse.io https://api.github.com https://*.sentry.io https://www.google-analytics.com https://*.hcaptcha.com https://hcaptcha.com https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location ws://127.0.0.1:* http://127.0.0.1:*; media-src 'self' https://cdn.discordapp.com/assets/ https://cdn.discordapp.com/promotions/premium-marketing/; frame-src https://discordapp.com/domain-migration https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/ https://*.hcaptcha.com https://hcaptcha.com https://challenges.cloudflare.com https://www.youtube.com/embed/ https://10851314.fls.doubleclick.net/;
cache-control
no-cache
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray
a34b472c0c3bdbcd-FRA
permissions-policy
interest-cohort=()
x-xss-protection
1; mode=block
server
cloudflare

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online) Go Pro

Only in urlscan Pro

Use our Phishing URL feed to retrieve phishing pages targeting 3000+ brands in real-time. Set up monitoring and alerts. Use maliciousness scores and AI-powered brand name recognition to hunt for brand impersonation.
Click for more information
Free trials of urlscan Pro are available.

3 JavaScript Window variables Go Pro

Only in urlscan Pro

Inspect and pivot on JavaScript variables, identifiers, and other key site metadata data with urlscan Pro. Reveal and search on client-side frameworks, runtime variables, and custom values.
Click for more information
Free trials of urlscan Pro are available.

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

function| onTurnstileSuccess object| _cf_translation object| turnstile

2 Cookies Go Pro

Only in urlscan Pro

Review, search, and pivot on browser cookies and persistence site data to see how a site tracks users and keeps sessions alive across visits.
Click for more information
Free trials of urlscan Pro are available.

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path Expires Name / Value
chatgpt0005.eu.org/ 1970-01-22
02:21:39 		Name: __dcfduid
Value: 9bad99a0a6ab11f197feff91b0790d9c
chatgpt0005.eu.org/ 1970-01-22
02:21:39 		Name: __sdcfduid
Value: 9bad99a1a6ab11f197feff91b0790d9c871b517d43616a94584a7178913f3f9f2fc757feb4b318c3a9ead3ef385c1b01

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source Level URL
Text
network error URL: https://chatgpt0005.eu.org/blog/discord-orbs
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://chatgpt0005.eu.org/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options SAMEORIGIN