urlscan.io logo urlscan.io
SecurityTrails logo

discord-nitro-free.ru Open in urlscan Pro
2a0a:2b43:8:7a98::  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://discord-nitro-free.ru/
Submission: On August 12 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 11 HTTP transactions. The main IP is 2a0a:2b43:8:7a98::, located in Russian Federation and belongs to SPRINTHOST, RU. The main domain is discord-nitro-free.ru.
This is the only time discord-nitro-free.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Discord (Instant Messenger)

Domain & IP information

IP Address AS Autonomous System
1 2a0a:2b43:8:7... 35278 (SPRINTHOST)
5 95.181.153.105 210993 (SPACECORE)
1 2a00:1450:400... 15169 (GOOGLE)
1 162.159.128.233 13335 (CLOUDFLAR...)
11 5
Domain Requested by
5 uniphish.com discord-nitro-free.ru
uniphish.com
1 discord.com discord-nitro-free.ru
1 fonts.googleapis.com discord-nitro-free.ru
1 discord-nitro-free.ru
11 4

This site contains links to these domains. Also see Links.

Domain
discord.com
Subject Issuer Validity Valid
uniphish.com
R3		 2021-07-25 -
2021-10-23		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2021-07-12 -
2021-10-04		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-01-19 -
2022-01-18		 a year crt.sh

This page contains 1 frames:

Primary Page: http://discord-nitro-free.ru/
Frame ID: BE3FCD864A755E1C36CCB5474B2AC7F7
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /openresty(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • headers server /openresty(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • headers server /openresty(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

11
Requests

64 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

5
IPs

3
Countries

1676 kB
Transfer

1691 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
discord-nitro-free.ru/ 		16 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://discord-nitro-free.ru/
Protocol
HTTP/1.1
Server
2a0a:2b43:8:7a98:: , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software
openresty /
Resource Hash
81426f67d943ad1104d3963a876ac74ffda8190a3c3cb4da3af74a9499b428dc

Request headers

Host
discord-nitro-free.ru
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Server
openresty
Date
Thu, 12 Aug 2021 12:20:34 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Vary
Accept-Encoding
Content-Encoding
gzip
style.css
uniphish.com/files/discord/css/ 		2 MB
2 MB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://uniphish.com/files/discord/css/style.css
Requested by
Host: discord-nitro-free.ru
URL: http://discord-nitro-free.ru/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.181.153.105 , Russian Federation, ASN210993 (SPACECORE, RU),
Reverse DNS
105.153.181.95.in-addr.arpa.spacecore.network
Software
nginx/1.14.2 /
Resource Hash
dfce177a5d09bbac9f93bbf98a7d4116a9c53940ae9ec1c2e659953aeb84c356
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
http://discord-nitro-free.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 12 Aug 2021 12:20:35 GMT
referrer-policy
same-origin
last-modified
Sat, 29 May 2021 16:40:57 GMT
server
nginx/1.14.2
etag
"60b26e99-186855"
x-frame-options
DENY
content-type
text/css
x-xss-protection
1; mode=block
content-security-policy
frame-ancestors 'self'
accept-ranges
bytes
x-robots-tag
none
content-length
1599573
x-content-type-options
nosniff
css2
fonts.googleapis.com/ 		8 KB
850 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Montserrat:wght@600&family=Roboto:wght@400;500;700&display=swap
Requested by
Host: discord-nitro-free.ru
URL: http://discord-nitro-free.ru/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
05be57638e1d7b36d84973cf36efcdb214a5839816f1fc0ffc6d64f07a63cadb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
http://discord-nitro-free.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Thu, 12 Aug 2021 12:07:09 GMT
server
ESF
date
Thu, 12 Aug 2021 12:20:34 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 12 Aug 2021 12:20:34 GMT
62139f1cff10402837062.js
uniphish.com/files/discord/js/ 		33 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://uniphish.com/files/discord/js/62139f1cff10402837062.js
Requested by
Host: discord-nitro-free.ru
URL: http://discord-nitro-free.ru/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.181.153.105 , Russian Federation, ASN210993 (SPACECORE, RU),
Reverse DNS
105.153.181.95.in-addr.arpa.spacecore.network
Software
nginx/1.14.2 /
Resource Hash
ffea85fb262e2898cfc8ab7ccda7dd302f237b2344ce0c71188ee05403a3bf49
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
http://discord-nitro-free.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 12 Aug 2021 12:20:35 GMT
referrer-policy
same-origin
last-modified
Wed, 23 Jun 2021 18:44:01 GMT
server
nginx/1.14.2
etag
"60d380f1-84e5"
x-frame-options
DENY
content-type
application/javascript; charset=utf-8
x-xss-protection
1; mode=block
content-security-policy
frame-ancestors 'self'
accept-ranges
bytes
x-robots-tag
none
content-length
34021
x-content-type-options
nosniff
antif12.js
uniphish.com/files/discord/js/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://uniphish.com/files/discord/js/antif12.js
Requested by
Host: discord-nitro-free.ru
URL: http://discord-nitro-free.ru/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.181.153.105 , Russian Federation, ASN210993 (SPACECORE, RU),
Reverse DNS
105.153.181.95.in-addr.arpa.spacecore.network
Software
nginx/1.14.2 /
Resource Hash
0790e74617ccc188b297f1495d507255ea9b13bb0a68db61c5184e850d5deed7
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
http://discord-nitro-free.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 12 Aug 2021 12:20:35 GMT
referrer-policy
same-origin
last-modified
Mon, 05 Jul 2021 00:48:29 GMT
server
nginx/1.14.2
etag
"60e256dd-440"
x-frame-options
DENY
content-type
application/javascript; charset=utf-8
x-xss-protection
1; mode=block
content-security-policy
frame-ancestors 'self'
accept-ranges
bytes
x-robots-tag
none
content-length
1088
x-content-type-options
nosniff
44e0c1fbcf99c4476083442e4a2774e0.svg
uniphish.com/files/discord/ 		65 KB
66 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://uniphish.com/files/discord/44e0c1fbcf99c4476083442e4a2774e0.svg
Requested by
Host: discord-nitro-free.ru
URL: http://discord-nitro-free.ru/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.181.153.105 , Russian Federation, ASN210993 (SPACECORE, RU),
Reverse DNS
105.153.181.95.in-addr.arpa.spacecore.network
Software
nginx/1.14.2 /
Resource Hash
0234d976909b6ed11fb6288a542b3e63bda21a5ab2672a2a9032780009ab58ac
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
http://discord-nitro-free.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 12 Aug 2021 12:20:35 GMT
referrer-policy
same-origin
last-modified
Tue, 18 May 2021 19:29:39 GMT
server
nginx/1.14.2
etag
"60a415a3-105e0"
x-frame-options
DENY
content-type
image/svg+xml
x-xss-protection
1; mode=block
content-security-policy
frame-ancestors 'self'
accept-ranges
bytes
x-robots-tag
none
content-length
67040
x-content-type-options
nosniff
439112b388adcac969dc066d30767b76.png
discord.com/assets/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://discord.com/assets/439112b388adcac969dc066d30767b76.png
Requested by
Host: discord-nitro-free.ru
URL: http://discord-nitro-free.ru/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.159.128.233 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
703e0c41341ad2e5143dc8d47d414e10aeaa5f052d399d951c3df0d3f1883a2e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
http://discord-nitro-free.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 12 Aug 2021 12:20:36 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
2454
x-xss-protection
1; mode=block
last-modified
Wed, 28 Apr 2021 21:33:57 GMT
server
cloudflare
x-frame-options
DENY
etag
"439112b388adcac969dc066d30767b76"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jV1I60z7dCDMyBnkCj1uM6acQsMFpnHjZ6iU%2BM6aaoZWZht%2B1rV%2F4PRZNr4lKXqtAjr%2FWo%2FAUPYSAoweDiWb%2B7p4%2F%2BY1FwH1ZSRXumsqHqZ9%2BtwVDCQCgA9RCPoM"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
https://discord.com
vary
Origin, Accept-Encoding
cache-control
public, max-age=2592000
permissions-policy
interest-cohort=()
accept-ranges
bytes
cf-ray
67d9a89f5ee90bc1-AMS
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9d094b1a42fe00a53e76d8f6238b78d2d9ee18ab5efabd10539c9800eecd2ff2

Request headers

Referer
http://discord-nitro-free.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
4f004ac9be168ac6ee18fc442a52ab53.svg
uniphish.com/assets/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://uniphish.com/assets/4f004ac9be168ac6ee18fc442a52ab53.svg
Requested by
Host: uniphish.com
URL: https://uniphish.com/files/discord/css/style.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.181.153.105 , Russian Federation, ASN210993 (SPACECORE, RU),
Reverse DNS
105.153.181.95.in-addr.arpa.spacecore.network
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://uniphish.com/files/discord/css/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
e8acd7d9bf6207f99350ca9f9e23b168.woff
uniphish.com/assets/ 		0
0
be0060dafb7a0e31d2a1ca17c0708636.woff
uniphish.com/assets/ 		0
0
3bdef1251a424500c1b3a78dea9b7e57.woff
uniphish.com/assets/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
uniphish.com
URL
https://uniphish.com/assets/e8acd7d9bf6207f99350ca9f9e23b168.woff
Domain
uniphish.com
URL
https://uniphish.com/assets/be0060dafb7a0e31d2a1ca17c0708636.woff
Domain
uniphish.com
URL
https://uniphish.com/assets/3bdef1251a424500c1b3a78dea9b7e57.woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Discord (Instant Messenger)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated number| webpackJsonp function| cmenu function| checkpole function| ohmygod

0 Cookies