Thank you for sharing this, OP. I didn't know that they could do that.

In my experience, I have verifications that doesn't lead to external websites. It's done everything in Discord. It's best to trust servers and others with verification modes to have that entire thing in Discord, and if it leads to a link, definitely a red flag already.

Might be a token or authorization thing from them and exploited something?