# PhishDestroy threat dossier — discord.quasarsoftware.net ================================================================ Fetched: 2026-07-30 09:56:41 UTC Canonical: https://phishdestroy.io/domain/discord.quasarsoftware.net/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Social Media Phishing Targeted brand: discord (and: google) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 7/93 security vendors flagged this domain Flagging vendors: ADMINUSLabs, Cluster25, CRDF, CyRadar, Fortinet, Gridinsoft, SOCRadar URLQuery: -1 detections Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 85.209.70.13 (RU, Peterhof) ASN: ASAS21030 CDNNOW-AS Docker LTD, RU Hosting org: AS21030 Cluster LLC Registered: 2026-02-21 Page title: Discord ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: R12 Status: INVALID chain ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-02-21 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-02-26 23:24:12 UTC (by PhishDestroy tracker) First reported: 2026-02-26 23:24:12 UTC (abuse notice filed) Last verified: 2026-07-30 08:55:12 UTC Neutralised: 2026-04-08 02:01:16 UTC Current status: taken down (registrar suspended or DNS dead) ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019b22b6-bc79-7262-81f4-e51239de3ec0/ Wayback Machine: https://web.archive.org/web/*/discord.quasarsoftware.net crt.sh CT logs: https://crt.sh/?q=%25.discord.quasarsoftware.net Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=discord.quasarsoftware.net AlienVault OTX: https://otx.alienvault.com/indicator/domain/discord.quasarsoftware.net URLhaus: https://urlhaus.abuse.ch/host/discord.quasarsoftware.net/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-25 04:26:15 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] Is discord.quasarsoftware.net a Discord impersonation? Analysis of discord.quasarsoftware.net indicates a brand impersonation campaign targeting Discord users. The domain was registered on February 21, 2026 and is currently marked offline. DNS resolution points to IP address 85.209.70.13, which resides in Russia and is announced by AS21030 Cluster LLC. The hosting infrastructure therefore originates from a Russian network, a factor that may affect response time for takedown actions. An SSL certificate labeled R12 is present, suggesting the use of a standard TLS certificate without further validation of its issuance authority. VirusTotal scans show that seven of ninety‑three security vendors flagged the domain, demonstrating modest detection across the scanning ecosystem. The domain appears on a single public blocklist and has been explicitly blocked by the PhishDestroy filtering service, reinforcing the view that it is recognized as malicious by at least one security community. The page title returned by the server is "Discord," matching the declared brand target and confirming the intent to masquerade as the official Discord service. The campaign is classified as Social Media Phishing, consistent with the brand impersonation label. No additional evidence about the page content, phishing kit, or credential capture mechanisms is available, leaving the exact user‑experience details uncertain. Defenders should continue to block the domain and its associated IP address at network perimeter devices, update URL filtering rules, and monitor for any re‑registration attempts. Given the modest vendor detection count, additional sandboxing or heuristic analysis of any future payloads linked to this infrastructure is advisable. Organizations that rely on Discord for internal communications should educate users about unsolicited login requests and enforce multi‑factor authentication to mitigate credential theft risks. ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/discord.quasarsoftware.net/ JSON API: https://api.destroy.tools/v1/check?domain=discord.quasarsoftware.net Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 195,592 domains (93,417 alive under monitoring, 99,913 confirmed takedowns/dead). Site: https://phishdestroy.io