discord[.]spielzeugfabrik[.]net

The domain discord.spielzeugfabrik.net was registered on March 28, 2026 through RegistryGate GmbH. It resolves to the IPv4 address 85.13.147.171, which is hosted by Neue Medien Muennich GmbH in Germany. The authoritative name servers are ns5.kasserver.com and ns6.kasserver.com.

When accessed via HTTP the server issues a 301 redirect and presents a TLS certificate issued by Let’s Encrypt (R12). The certificate is valid for the domain and does not raise immediate trust issues, but the use of a free certificate is common among malicious actors. The page title returned is "Discord", matching a popular brand, and the domain is currently flagged by the PhishDestroy blocklist and appears on one additional security blocklist. Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal reports 0 detections out of 95 scans, indicating that the site has not yet been widely identified by scanners.

Analysis indicates that the infrastructure aligns with a typical generic phishing campaign targeting Discord users. The combination of a brand‑matching page title, a recent registration date, and a low trust score suggests intent to deceive. However, the lack of detections on VirusTotal and the absence of public malware samples leave the exact payload or credential‑harvesting mechanism uncertain. No additional indicators such as malicious scripts or exfiltration endpoints have been disclosed.

Defenders should treat discord.spielzeugfabrik.net as a high‑confidence phishing indicator. Immediate actions include adding the domain to DNS and web‑proxy block lists, monitoring DNS queries for the associated IP address, and enabling TLS inspection to capture any credential submissions. Ongoing surveillance of the IP reputation and periodic rescans with multi‑engine services are recommended to detect future changes in malicious behavior.