# PhishDestroy domain threat record: discordzapretik.sbs

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/discordzapretik.sbs/
Machine-readable companion: https://phishdestroy.io/domain/discordzapretik.sbs/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-22 12:57:06 UTC
- Last availability or vendor check: 2026-10-22 12:57:06 UTC
- Stored record updated: 2026-10-22 16:30:30 UTC
- VirusTotal detections in the stored snapshot: 2/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Discord

## Stored infrastructure

- Observed IP address: 31.56.209.239
- Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED
- Last stored HTTP status: 200
- Registration date (registry RDAP, discordzapretik.sbs): 2026-10-17 12:26:00 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a163ae-db86-70ef-87a7-44e1c69d15bc/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/discordzapretik.sbs
- Certificate Transparency search: https://crt.sh/?q=%25.discordzapretik.sbs
- Web Archive lookup: https://web.archive.org/web/*/https://discordzapretik.sbs/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s automated intake flagged discordzapretik.sbs because VirusTotal reported one vendor as malicious within five days of registration. The recorded page title and excerpt claim to provide a free “Discord Zapret” VPN for Windows and to offer a download of DiscordZapret.exe. The domain was first seen by PhishDestroy on 2026-10-22, five days after its registration on 2026-10-17, and returned an HTTP 200 response at that time.

How the scam works
Fake VPN tools that reference popular services such as Discord lure users into downloading an executable that claims to bypass blocks or improve performance. The downloaded file can install malware, adware, or steal credentials, using the brand name only to increase credibility.

Evidence
VirusTotal scanned the domain on 2026-10-20 and recorded two detections out of 92 engines, with Webroot labeling it malicious and Fortinet labeling it as spam. Google Safe Browsing checked on 2026-10-22 did not flag the site, and OTX reported zero pulses on the same date. urlscan captured the page on 2026-10-22; its engine verdict marked the site malicious with a score of 98, while the overall urlscan verdict was non‑malicious, and PhishDestroy’s internal blocklist contains the domain while external blocklists returned no matches.

Infrastructure
The domain was registered with NICENIC INTERNATIONAL GROUP CO., LIMITED on 2026-10-17 and resolves to IP 31.56.209.239, hosted by Swissnet LLC in the Netherlands. TLS was provided by a Let’s Encrypt certificate valid from 2026-10-18 to 2027-01-16, and the domain uses Cloudflare nameservers albert.ns.cloudflare.com and sureena.ns.cloudflare.com. Recorded open ports include 80, 443 and 3389, and DNSSEC is not enabled.

What to do
Do not download or execute the offered DiscordZapret.exe file; if it has already been saved, run a reputable anti‑malware scan and delete the file. Users who entered Discord credentials should change those passwords immediately. Defenders should add the domain to blocklists, monitor network logs for connections to the recorded IP, and, if the executable hash is known, block it at the endpoint level.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a163ae-db86-70ef-87a7-44e1c69d15bc/
Cloudflare Radar report: https://radar.cloudflare.com/scan/c29e1974-8bd0-4c0e-95b8-86b410751e7f
Stored capture screenshot: https://i.ibb.co/FLnY49Mz/88e757295986.png
Cloudflare Radar screenshot (2026-10-22T12:58:23Z): https://screenshots.phishdestroy.io/cf/c29e1974-8bd0-4c0e-95b8-86b410751e7f.png
VirusTotal report: https://www.virustotal.com/gui/domain/discordzapretik.sbs
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=discordzapretik.sbs
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-22 13:01:18 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/FLnY49Mz/88e757295986.png
  Captured: 2026-10-22 12:57:06 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a163ae-db86-70ef-87a7-44e1c69d15bc.png
  Captured: 2026-10-22 12:57:06 UTC
  Source report: https://urlscan.io/result/01a163ae-db86-70ef-87a7-44e1c69d15bc/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/c29e1974-8bd0-4c0e-95b8-86b410751e7f.png
  Captured: 2026-10-22 12:58:23 UTC
  Source report: https://radar.cloudflare.com/scan/c29e1974-8bd0-4c0e-95b8-86b410751e7f
  SHA-256: b13c4279c953ce83de65d23a58c700597ba26d7dbeb66da29a38baa6c8954b9c

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-22T13:00:23Z",
        "uuid": "01a163ae-db86-70ef-87a7-44e1c69d15bc",
        "scanned_at": "2026-10-22T12:56:14Z",
        "final_url": "https://discordzapretik.sbs/",
        "status": 200,
        "ip": "31.56.209.239",
        "ptr": "sjcczkzewj9q.server.swissnetwork.io",
        "domains": [
            "fonts.gstatic.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.250.195.99",
            "142.250.183.42",
            "31.56.209.239"
        ],
        "asns": [
            "15169",
            "209373"
        ],
        "countries": [
            "US",
            "NL"
        ],
        "link_domains": [
            "t.me"
        ],
        "social": [
            "https://t.me/zapretik_support"
        ],
        "doc_hash": "1040a690313ec27cb14df64173c29ce9d007daf1cc004928a14f777f763ec00a",
        "tls": {
            "san": [
                "discordzapretik.sbs"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR2",
            "subject": "discordzapretik.sbs",
            "protocol": "TLS 1.2",
            "valid_to": "2027-01-16T10:20:14Z",
            "valid_from": "2026-10-18T10:20:15Z"
        },
        "domain_age_days": 3,
        "apex_age_days": 3,
        "tls_age_days": 4,
        "tls_valid_days": 89,
        "requests": 8,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 98,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "Microsoft-IIS/10.0",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-22T13:00:26Z",
        "uuid": "c29e1974-8bd0-4c0e-95b8-86b410751e7f",
        "scanned_at": "2026-10-22T12:58:23Z",
        "final_url": "https://discordzapretik.sbs/",
        "status": 200,
        "history": [
            {
                "url": "https://discordzapretik.sbs/",
                "status": 200
            }
        ],
        "dom_hash": "17e83e0786cf07641e2d40c3d2f47f454424d6fdfca59035355f54d5b4d64c79",
        "doc_hash": "1040a690313ec27cb14df64173c29ce9d007daf1cc004928a14f777f763ec00a",
        "domain_risks": [
            "New Domains",
            "Security Risks",
            "Newly Seen Domains"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "discordzapretik.sbs",
                "type": "A",
                "value": "31.56.209.239"
            }
        ],
        "dnssec_valid": false,
        "ip": "31.56.209.239",
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-10-17T12:26:00Z",
            "updated": "2026-10-17T12:26:01Z",
            "expires": "2027-10-17T23:59:59Z",
            "nameservers": [
                "albert.ns.cloudflare.com",
                "sureena.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T12:58:11Z",
        "analysis_at": "2026-10-20T06:13:17Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 1,
            "suspicious": 1,
            "undetected": 38
        },
        "detections": {
            "Webroot": "malicious",
            "Fortinet": "spam"
        },
        "reputation": 0,
        "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
        "created": "2026-10-17T12:26:00Z",
        "expires": "2027-10-17T23:59:59Z",
        "updated": "2026-10-17T12:26:01Z",
        "first_seen": "2026-10-17T13:55:24Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "31.56.209.239"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "albert.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "sureena.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "albert.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-20T06:13:37Z",
        "jarm": "2ad2ad16d00000022c2ad2ad2ad2adc08b3be7d1a4f5f4d1fd42f049726e8a",
        "cert": {
            "san": [
                "discordzapretik.sbs"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "69358010c9be57d7c4c450557d528586a65",
            "sha256": "71d2efbddac1cfdb894f8ae68de33235ce0110af4de1ef26284aab931e9ca60f",
            "subject": "discordzapretik.sbs",
            "valid_to": "2027-01-16T10:20:14Z",
            "valid_from": "2026-10-18T10:20:15Z"
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "registrar_iana_id": "3765",
            "registrar_url": "https://nicenic.com",
            "created": "2026-10-16T16:00:00Z",
            "updated": "2026-10-16T16:00:00Z",
            "expires": "2027-10-17T16:00:00Z",
            "status": [
                "addPeriod",
                "clientDeleteProhibited",
                "clientTransferProhibited",
                "serverTransferProhibited"
            ],
            "nameservers": [
                "albert.ns.cloudflare.com",
                "sureena.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-22T13:00:37Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "discordzapretik.sbs"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-22T12:59:15Z",
            "first": "2026-10-22T12:59:15Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 7273
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://discordzapretik.sbs/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 1
        },
        "social_tags": {
            "ogUrl": "https://discordzapretik.sbs/",
            "title": "Скачать Discord Zapret — Discord VPN бесплатно для Windows | discordzapretik.sbs",
            "author": "Discord Zapret",
            "ogType": "website",
            "robots": "index, follow",
            "ogTitle": "Скачать Discord Zapret — Discord VPN бесплатно",
            "keywords": "discord vpn, discord zapretik, скачать дискорд впн, zapret discord, обход блокировки дискорда, голосовые каналы дискорд не работают, vpn для дискорда бесплатно",
            "ogSiteName": "Discord Zapret",
            "themeColor": "#03040d",
            "description": "Скачать Discord Zapret бесплатно — VPN для Discord на Windows 10/11. Рабочие голосовые каналы, стримы и звонки без обрывов. Настройка за 30 секунд.",
            "twitterCard": "summary_large_image",
            "canonicalUrl": "https://discordzapretik.sbs/",
            "ogDescription": "Discord без блокировок и обрывов голосовых. Бесплатный Zapret-VPN для Discord. Скачай за 30 секунд."
        },
        "trackers": {
            "requests": 6,
            "trackers": [
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 3
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 2,
                "tls": 75,
                "wait": 29,
                "connect": 26,
                "download": 2
            },
            "response_ms": 134
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "ECDHE-RSA-AES256-GCM-SHA384",
            "protocol": "TLSv1.2",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                3389
            ]
        },
        "carbon": {
            "bytes": 23683,
            "co2_grams": 0.0009,
            "cleaner_than": 53
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.33.58",
                    "host": "albert.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.34.126",
                    "host": "sureena.ns.cloudflare.com"
                }
            ],
            "zone": "discordzapretik.sbs"
        },
        "location": {
            "ip": "31.56.209.239",
            "asn": "209373",
            "org": "Swissnet LLC",
            "city": "Eygelshoven",
            "country": "NL"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR2",
            "subject": "discordzapretik.sbs"
        },
        "dns": {
            "A": [
                "31.56.209.239"
            ],
            "NS": [
                "albert.ns.cloudflare.com",
                "sureena.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"albert.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2417807545, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "31.56.209.239",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://discordzapretik.sbs"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Windows Server",
                "IIS",
                "Google Font API",
                "Open Graph"
            ]
        },
        "linked_pages": {
            "external": [
                "https://t.me/zapretik_support"
            ],
            "external_count": 1,
            "internal_count": 7
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-10-17T12:26:00Z",
            "updated": "2026-10-22T12:30:00Z",
            "expires": "2027-10-17T23:59:59Z",
            "status": [
                "serverTransferProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp",
                "clientDeleteProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "albert.ns.cloudflare.com",
                "sureena.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "Microsoft-IIS/10.0",
                "content-type": "text/html"
            }
        }
    }
}
```