discorde.ml Open in urlscan Pro
2a05:d014:275:cb02::c8  Malicious Activity! Public Scan

URL: https://discorde.ml/
Submission Tags: phishingrod
Submission: On November 23 via api from DE — Scanned from DE

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 9 HTTP transactions. The main IP is 2a05:d014:275:cb02::c8, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is discorde.ml.
TLS certificate: Issued by R3 on November 23rd 2022. Valid for: 3 months.
This is the only time discorde.ml was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Discord (Instant Messenger)

Domain & IP information

IP Address AS Autonomous System
4 2a05:d014:275... 16509 (AMAZON-02)
1 2a04:4e42:600... 54113 (FASTLY)
1 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
9 4
Apex Domain
Subdomains
Transfer
4 discorde.ml
discorde.ml
153 KB
3 gstatic.com
fonts.gstatic.com
49 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 43
1005 B
1 redd.it
preview.redd.it — Cisco Umbrella Rank: 2877
2 KB
9 4
Domain Requested by
4 discorde.ml discorde.ml
3 fonts.gstatic.com fonts.googleapis.com
1 fonts.googleapis.com discorde.ml
1 preview.redd.it discorde.ml
9 4

This site contains no links.

Subject Issuer Validity Valid
*.discorde.ml
R3
2022-11-23 -
2023-02-21
3 months crt.sh
*.redd.it
DigiCert TLS RSA SHA256 2020 CA1
2022-11-17 -
2023-05-15
6 months crt.sh
upload.video.google.com
GTS CA 1C3
2022-11-02 -
2023-01-25
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2022-11-02 -
2023-01-25
3 months crt.sh

This page contains 1 frames:

Primary Page: https://discorde.ml/
Frame ID: 6AE5C94E39430CF7A1C01D688285E4FD
Requests: 9 HTTP requests in this frame

Screenshot

Page Title

Discord

Page Statistics

9
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

205 kB
Transfer

209 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
discorde.ml/
2 KB
1 KB
Document
General
Full URL
https://discorde.ml/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a05:d014:275:cb02::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Netlify /
Resource Hash
071901343787d3308c75cf920c458378201c87483e566e897d19568164ba341a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
0
cache-control
public, max-age=0, must-revalidate
content-encoding
br
content-type
text/html; charset=UTF-8
date
Wed, 23 Nov 2022 10:14:03 GMT
etag
"947b421530307415e3fb97a623acd58f-ssl-df"
server
Netlify
strict-transport-security
max-age=31536000
vary
Accept-Encoding
x-nf-request-id
01GJHZNX4AAEM4H9V9R37NGVS9
style.css
discorde.ml/
3 KB
917 B
Stylesheet
General
Full URL
https://discorde.ml/style.css
Requested by
Host: discorde.ml
URL: https://discorde.ml/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a05:d014:275:cb02::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Netlify /
Resource Hash
d610204c3d62bb488ed228d3143e2f96a2014b9b4f031cb09ebed698a7006aa8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://discorde.ml/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-nf-request-id
01GJHZNXASVTZ7WRC63S0Y3TQ7
date
Wed, 23 Nov 2022 10:14:03 GMT
content-encoding
br
strict-transport-security
max-age=31536000
server
Netlify
age
0
etag
"1972b9169b939f114484e826bb23078d-ssl-df"
vary
Accept-Encoding
content-type
text/css; charset=UTF-8
cache-control
public, max-age=0, must-revalidate
accept-ranges
bytes
mc9eliol80o71.png
preview.redd.it/
1 KB
2 KB
Image
General
Full URL
https://preview.redd.it/mc9eliol80o71.png?width=200&format=png&auto=webp&s=8f535889b348079c0a086387fb5afc16bf03a6b8
Requested by
Host: discorde.ml
URL: https://discorde.ml/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
snooserv /
Resource Hash
8cc0944515298112974228ce616560e13561b7d40318bbf00dbdc26eb1f191d6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://discorde.ml/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Wed, 23 Nov 2022 10:14:03 GMT
via
1.1 varnish, 1.1 varnish
nel
{"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.2, "failure_fraction": 0.2}
server
snooserv
etag
"QF+RNR7K/cX0tYO0wdZIaGWCXmJ/VpqOIraH1PCfljw"
vary
Accept,Origin
report-to
{"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}
fastly-io-info
ifsz=2188 idim=200x200 ifmt=png ofsz=1116 odim=200x200 ofmt=webp
content-type
image/webp
fastly-stats
io=1
accept-ranges
bytes
content-length
1116
expires
Thu, 31 Dec 2037 23:59:59 GMT
script.js
discorde.ml/
1 KB
453 B
Script
General
Full URL
https://discorde.ml/script.js
Requested by
Host: discorde.ml
URL: https://discorde.ml/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a05:d014:275:cb02::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Netlify /
Resource Hash
6f8186803391e032485fafb457309d861b33c3dd284f9a99ed58e30ada9a1555
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://discorde.ml/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-nf-request-id
01GJHZNXB8HFH01GRT4RZP8P50
date
Wed, 23 Nov 2022 10:14:03 GMT
content-encoding
br
strict-transport-security
max-age=31536000
server
Netlify
age
0
etag
"299dec88e75cf0ff364911bb787edc56-ssl-df"
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=0, must-revalidate
accept-ranges
bytes
css2
fonts.googleapis.com/
3 KB
1005 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Hind:wght@400;600;700&display=swap
Requested by
Host: discorde.ml
URL: https://discorde.ml/style.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
63e36a8d13fd6941a9ab98cf4bd1c535598951e448b27bf00379a1dde798b8c1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://discorde.ml/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Wed, 23 Nov 2022 10:14:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Wed, 23 Nov 2022 10:14:04 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 23 Nov 2022 10:14:04 GMT
bg.png
discorde.ml/
150 KB
151 KB
Image
General
Full URL
https://discorde.ml/bg.png
Requested by
Host: discorde.ml
URL: https://discorde.ml/style.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a05:d014:275:cb02::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Netlify /
Resource Hash
9a7c59f1d229c9d5d2b7443109850832d134d007ff6b92034675c90bd6cbe57a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://discorde.ml/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-nf-request-id
01GJHZNXGF9C8KBQ5DQBPKJKZ2
date
Wed, 23 Nov 2022 10:14:04 GMT
strict-transport-security
max-age=31536000
server
Netlify
age
0
etag
"d755703a1029926752afb94e8cdfa54e-ssl"
content-type
image/png
cache-control
public, max-age=0, must-revalidate
accept-ranges
bytes
content-length
153997
5aU19_a8oxmIfNJdERySjQ.woff2
fonts.gstatic.com/s/hind/v16/
16 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/hind/v16/5aU19_a8oxmIfNJdERySjQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Hind:wght@400;600;700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5aed4a8f357d7edc1ac50eb4de07867c83e69a10a1711e10053bddce99294b7e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://discorde.ml
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Tue, 22 Nov 2022 17:18:07 GMT
x-content-type-options
nosniff
age
60957
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
16268
x-xss-protection
0
last-modified
Tue, 26 Apr 2022 15:48:34 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 22 Nov 2023 17:18:07 GMT
5aU69_a8oxmIdGl4BA.woff2
fonts.gstatic.com/s/hind/v16/
16 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/hind/v16/5aU69_a8oxmIdGl4BA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Hind:wght@400;600;700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
aca5dec430a7470ff1d8a16f9e7bb3ca30f2ff58f3bd60432cf1dddfa30c9d71
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://discorde.ml
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Sat, 19 Nov 2022 16:33:09 GMT
x-content-type-options
nosniff
age
322855
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
16216
x-xss-protection
0
last-modified
Tue, 26 Apr 2022 15:45:50 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 19 Nov 2023 16:33:09 GMT
5aU19_a8oxmIfLZcERySjQ.woff2
fonts.gstatic.com/s/hind/v16/
16 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/hind/v16/5aU19_a8oxmIfLZcERySjQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Hind:wght@400;600;700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
078751117ee4d17e09b4d4ac5d9f7358bc4487cb94561df738c6ee000eeffb4d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://discorde.ml
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Tue, 22 Nov 2022 17:18:03 GMT
x-content-type-options
nosniff
age
60961
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
16612
x-xss-protection
0
last-modified
Tue, 26 Apr 2022 15:46:40 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 22 Nov 2023 17:18:03 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Discord (Instant Messenger)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| formSubmit

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000