discord-gift.kro.kr - urlscan.io

Summary

This website contacted 5 IPs in 1 countries across 5 domains to perform 5 HTTP transactions. The main IP is 2606:50c0:8003::153, located in United States and belongs to FASTLY, US. The main domain is discord-gift.kro.kr.

This is the only time discord-gift.kro.kr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Discord (Instant Messenger)

Domain & IP information

	IP Address	AS Autonomous System
1	2606:50c0:800... 2606:50c0:8003::153	54113 (FASTLY) (FASTLY)
1 2	2606:4700::68... 2606:4700::6810:7baf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.165.183.92 18.165.183.92	16509 (AMAZON-02) (AMAZON-02)
1	2a04:4e42:200... 2a04:4e42:200::396	54113 (FASTLY) (FASTLY)
1	2606:4700::68... 2606:4700::6810:5714	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	5

1 2606:50c0:8003::153 (United States)

ASN54113 (FASTLY, US)

discord-gift.kro.kr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:7baf (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.165.183.92 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-165-183-92.zrh55.r.cloudfront.net

i1.sndcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::396 (United States)

ASN54113 (FASTLY, US)

i.redd.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5714 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	unpkg.com 1 redirects unpkg.com — Cisco Umbrella Rank: 753	274 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 306	9 KB
1	redd.it i.redd.it — Cisco Umbrella Rank: 5946	2 KB
1	sndcdn.com i1.sndcdn.com — Cisco Umbrella Rank: 11311	11 KB
1	kro.kr discord-gift.kro.kr	27 KB
5	5

	Domain	Requested by
2	unpkg.com	1 redirects discord-gift.kro.kr
1	cdn.jsdelivr.net	discord-gift.kro.kr
1	i.redd.it	discord-gift.kro.kr
1	i1.sndcdn.com	discord-gift.kro.kr
1	discord-gift.kro.kr
5	5

This site contains links to these domains. Also see Links.

Domain
www.youtube.com

Subject Issuer	Validity	Valid
*.sndcdn.com GlobalSign GCC R3 DV TLS CA 2020	`2024-02-08` - `2025-03-11`	a year	crt.sh
*.redd.it DigiCert TLS RSA SHA256 2020 CA1	`2024-01-16` - `2024-07-13`	6 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-02` - `2024-05-01`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://discord-gift.kro.kr/
Frame ID: B89425CD3E923436A1C181D30CCE5D71
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Discord Nitro를 선물 받았어요!

Detected technologies

Alpine.js (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

/alpine(?:\.min)?\.js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

5
Requests

60 %
HTTPS

80 %
IPv6

5
Domains

5
Subdomains

5
IPs

1
Countries

323 kB
Transfer

2976 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.youtube.com/watch?v=dQw4w9WgXcQ
Title: 수락

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://unpkg.com/tailwindcss@%5E2/dist/tailwind.min.css HTTP 302
https://unpkg.com/tailwindcss@2.2.19/dist/tailwind.min.css

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
discord-gift.kro.kr/ 73 KB
27 KB 864ms
105ms Document
text/html 2606:50c0:8003::153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: http://discord-gift.kro.kr/
Protocol: HTTP/1.1
Server: 2606:50c0:8003::153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: GitHub.com /
Resource Hash: fe156e84a32dfdcf0dd9f2b7817451583e713259fbf0cbf2166846cdb2648563

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 0
Cache-Control: max-age=600
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 27429
Content-Type: text/html; charset=utf-8
Date: Wed, 28 Feb 2024 22:24:08 GMT
ETag: W/"620e424c-124db"
Last-Modified: Thu, 17 Feb 2022 12:40:44 GMT
Server: GitHub.com
Vary: Accept-Encoding
Via: 1.1 varnish
X-Cache: MISS
X-Cache-Hits: 0
X-Fastly-Request-ID: 231e27baabf27ba217d6d7def50b1e63c73ab4c7
X-GitHub-Request-Id: 0FE0:0E10:1966811:19D8907:65DFB288
X-Served-By: cache-fra-eddf8230105-FRA
X-Timer: S1709159048.321763,VS0,VE98
expires: Wed, 28 Feb 2024 22:34:08 GMT
x-proxy-cache: MISS

GET
H2

200

tailwind.min.css
unpkg.com/tailwindcss@2.2.19/dist/
Redirect Chain

https://unpkg.com/tailwindcss@%5E2/dist/tailwind.min.css
https://unpkg.com/tailwindcss@2.2.19/dist/tailwind.min.css

3 MB
274 KB

27ms
27ms

Stylesheet
text/css

2606:4700::6810:7baf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/tailwindcss@2.2.19/dist/tailwind.min.css

Requested by

Host: discord-gift.kro.kr
URL: http://discord-gift.kro.kr/

Protocol

H2

Server

2606:4700::6810:7baf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b6ad97402eddb903e7a5d7a73ee47a679204efbdda4521a391cbad9df509b932

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://discord-gift.kro.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 28 Feb 2024 22:24:08 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 7844713
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id: 01HGF3S49YPXNFVX62H4N219C9-fra
server: cloudflare
etag: W/"2cc503-cyTPK4s7rX9aC3Y3NNaHIxjV1fQ"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 85cc1374edbf9b2d-FRA

Redirect headers

date: Wed, 28 Feb 2024 22:24:08 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
fly-request-id: 01HQRWPP8HM48S491SB08176Y3-fra
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 396
vary: Accept, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
location: /tailwindcss@2.2.19/dist/tailwind.min.css
cache-control: public, s-maxage=600, max-age=60
cf-ray: 85cc1374cdb39b2d-FRA

GET
H2 200 avatars-WnxO40ryvv3YEAte-Oq76Wg-t500x500.jpg
i1.sndcdn.com/ 11 KB
11 KB 95ms
16ms Image
image/jpeg 18.165.183.92
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i1.sndcdn.com/avatars-WnxO40ryvv3YEAte-Oq76Wg-t500x500.jpg
Requested by: Host: discord-gift.kro.kr
URL: http://discord-gift.kro.kr/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.183.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-183-92.zrh55.r.cloudfront.net
Software: /
Resource Hash: fef81815692389ed380ddb522e3ec691d4a05db731961919a108cc2c2892e982

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://discord-gift.kro.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 12:02:18 GMT
via: 1.1 b50b0f4274b74414c7dcdb544e6090a2.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH55-P1
age: 1074110
x-cache: Hit from cloudfront
access-control-allow-methods: GET
access-control-allow-origin: *
content-type: image/jpeg
cache-control: public,max-age=3628800
access-control-allow-headers: Accept, Accept-Encoding, Authorization, Content-Type, Origin
content-length: 10907
x-amz-cf-id: xZtSsaZGbLOVbS00SLpM6YXOYhbYgIX9v2Vh-3GhmvAffhC5_yjJfw==

GET
H2 404 0037pi1sppm71.png
i.redd.it/ 1 KB
2 KB 157ms
123ms Image
image/png 2a04:4e42:200::396
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.redd.it/0037pi1sppm71.png
Requested by: Host: discord-gift.kro.kr
URL: http://discord-gift.kro.kr/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 35a0932c61e09a8c1cad9eec75b67a03602056463ed210310d2a09cf0b002ed5

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://discord-gift.kro.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-canonical-filename-image-generation: 1
x-amz-version-id: null
via: 1.1 varnish, 1.1 varnish
date: Wed, 28 Feb 2024 22:24:08 GMT
last-modified: Thu, 06 Oct 2016 22:56:01 GMT
server: snooserv
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 1.0, "failure_fraction": 1.0}
etag: "f17b01901c752c1bb04928131d1661af"
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: image/png
accept-ranges: bytes
fastly-restarts: 2
content-length: 1048

GET
H2 200 alpine.min.js Show response
cdn.jsdelivr.net/gh/alpinejs/alpine@v2.x.x/dist/ 26 KB
9 KB 40ms
16ms Script
application/javascript 2606:4700::6810:5714
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/alpinejs/alpine@v2.x.x/dist/alpine.min.js

Requested by

Host: discord-gift.kro.kr
URL: http://discord-gift.kro.kr/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d8827be28306cf93c85e6569217eabacb1a73b1d9695a34808be8e0763c7dc48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://discord-gift.kro.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 28 Feb 2024 22:24:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 27747
x-jsd-version: 2.8.2
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230038-FRA, cache-lga21940-LGA
x-jsd-version-type: version
server: cloudflare
etag: W/"696b-A4xZE4yqj5v55fcBdzwGjb0Th4k"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kRhYNsCZDfpcKjhAPdnXx7qo6mZ9PDCAX1bTW9maQe37Ct4KrVt18JqTo3AaLF6GXcNgpB0C9IQLsiaLlOWzys0tTDPBbvEBe2NwrSrgrBEVtBGazy%2BryJbdEJEadfLIJsybhnnyJKJoTthaO9Q%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 85cc1374de18bbf2-FRA

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Discord (Instant Messenger)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| Alpine

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://i.redd.it/0037pi1sppm71.png Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
discord-gift.kro.kr
i.redd.it
i1.sndcdn.com
unpkg.com
18.165.183.92
2606:4700::6810:5714
2606:4700::6810:7baf
2606:50c0:8003::153
2a04:4e42:200::396
35a0932c61e09a8c1cad9eec75b67a03602056463ed210310d2a09cf0b002ed5
b6ad97402eddb903e7a5d7a73ee47a679204efbdda4521a391cbad9df509b932
d8827be28306cf93c85e6569217eabacb1a73b1d9695a34808be8e0763c7dc48
fe156e84a32dfdcf0dd9f2b7817451583e713259fbf0cbf2166846cdb2648563
fef81815692389ed380ddb522e3ec691d4a05db731961919a108cc2c2892e982

discord-gift.kro.kr Open in urlscan Pro 2606:50c0:8003::153 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

5 Requests

60 %HTTPS

80 %IPv6

5 Domains

5 Subdomains

5 IPs

1 Countries

323 kBTransfer

2976 kBSize

0 Cookies

1 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

discord-gift.kro.kr Open in urlscan Pro
2606:50c0:8003::153 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

60 %
HTTPS

80 %
IPv6

5
Domains

5
Subdomains

5
IPs

1
Countries

323 kB
Transfer

2976 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!