discord-gift.kro.kr - urlscan.io

Summary

This website contacted 5 IPs in 1 countries across 5 domains to perform 5 HTTP transactions. The main IP is 2606:50c0:8001::153, located in United States and belongs to FASTLY, US. The main domain is discord-gift.kro.kr.

This is the only time discord-gift.kro.kr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Discord (Instant Messenger)

Domain & IP information

	IP Address	AS Autonomous System
1	2606:50c0:800... 2606:50c0:8001::153	54113 (FASTLY) (FASTLY)
1 2	2606:4700::68... 2606:4700::6810:7caf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	52.222.191.31 52.222.191.31	16509 (AMAZON-02) (AMAZON-02)
1	2a04:4e42:200... 2a04:4e42:200::396	54113 (FASTLY) (FASTLY)
1	2606:4700::68... 2606:4700::6810:5614	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	5

1 2606:50c0:8001::153 (United States)

ASN54113 (FASTLY, US)

discord-gift.kro.kr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:7caf (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.191.31 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-191-31.ham50.r.cloudfront.net

i1.sndcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::396 (United States)

ASN54113 (FASTLY, US)

i.redd.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5614 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	unpkg.com 1 redirects unpkg.com — Cisco Umbrella Rank: 1326	274 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 438	9 KB
1	redd.it i.redd.it — Cisco Umbrella Rank: 5682	2 KB
1	sndcdn.com i1.sndcdn.com — Cisco Umbrella Rank: 14143	11 KB
1	kro.kr discord-gift.kro.kr	27 KB
5	5

	Domain	Requested by
2	unpkg.com	1 redirects discord-gift.kro.kr
1	cdn.jsdelivr.net	discord-gift.kro.kr
1	i.redd.it	discord-gift.kro.kr
1	i1.sndcdn.com	discord-gift.kro.kr
1	discord-gift.kro.kr
5	5

This site contains links to these domains. Also see Links.

Domain
www.youtube.com

Subject Issuer	Validity	Valid
*.sndcdn.com GlobalSign GCC R3 DV TLS CA 2020	`2023-01-24` - `2024-02-25`	a year	crt.sh
*.redd.it DigiCert TLS RSA SHA256 2020 CA1	`2023-09-01` - `2024-02-28`	6 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-02` - `2024-05-01`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://discord-gift.kro.kr/
Frame ID: 7DCAAD66DDCBD6DEE4DD55AFE8562381
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Discord Nitro를 선물 받았어요!

Detected technologies

Alpine.js (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

/alpine(?:\.min)?\.js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

5
Requests

60 %
HTTPS

80 %
IPv6

5
Domains

5
Subdomains

5
IPs

1
Countries

323 kB
Transfer

2976 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.youtube.com/watch?v=dQw4w9WgXcQ
Title: 수락

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://unpkg.com/tailwindcss@%5E2/dist/tailwind.min.css HTTP 302
https://unpkg.com/tailwindcss@2.2.19/dist/tailwind.min.css

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
discord-gift.kro.kr/ 73 KB
27 KB 661ms
113ms Document
text/html 2606:50c0:8001::153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: http://discord-gift.kro.kr/
Protocol: HTTP/1.1
Server: 2606:50c0:8001::153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: GitHub.com /
Resource Hash: fe156e84a32dfdcf0dd9f2b7817451583e713259fbf0cbf2166846cdb2648563

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 0
Cache-Control: max-age=600
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 27429
Content-Type: text/html; charset=utf-8
Date: Thu, 11 Jan 2024 03:10:58 GMT
ETag: W/"620e424c-124db"
Last-Modified: Thu, 17 Feb 2022 12:40:44 GMT
Server: GitHub.com
Vary: Accept-Encoding
Via: 1.1 varnish
X-Cache: HIT
X-Cache-Hits: 1
X-Fastly-Request-ID: 57b06db5ed4a4796940faac65f1ae62d0431a82c
X-GitHub-Request-Id: 7146:F4000:203B719:20B6565:659F2F5C
X-Served-By: cache-ams21083-AMS
X-Timer: S1704942659.744699,VS0,VE100
expires: Thu, 11 Jan 2024 00:09:25 GMT
x-proxy-cache: MISS

GET
H2

200

tailwind.min.css
unpkg.com/tailwindcss@2.2.19/dist/
Redirect Chain

https://unpkg.com/tailwindcss@%5E2/dist/tailwind.min.css
https://unpkg.com/tailwindcss@2.2.19/dist/tailwind.min.css

3 MB
274 KB

24ms
24ms

Stylesheet
text/css

2606:4700::6810:7caf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/tailwindcss@2.2.19/dist/tailwind.min.css

Requested by

Host: discord-gift.kro.kr
URL: http://discord-gift.kro.kr/

Protocol

H2

Server

2606:4700::6810:7caf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b6ad97402eddb903e7a5d7a73ee47a679204efbdda4521a391cbad9df509b932

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://discord-gift.kro.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 03:10:58 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 3634083
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id: 01HGEY9B84HRHTD9RWEVD68AJE-fra
server: cloudflare
etag: W/"2cc503-cyTPK4s7rX9aC3Y3NNaHIxjV1fQ"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8439f842199239ca-FRA

Redirect headers

date: Thu, 11 Jan 2024 03:10:58 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
fly-request-id: 01HKV7GR50981R4YNTPKCEJ520-fra
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 525
vary: Accept, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
location: /tailwindcss@2.2.19/dist/tailwind.min.css
cache-control: public, s-maxage=600, max-age=60
cf-ray: 8439f841f98339ca-FRA

GET
H2 200 avatars-WnxO40ryvv3YEAte-Oq76Wg-t500x500.jpg
i1.sndcdn.com/ 11 KB
11 KB 88ms
30ms Image
image/jpeg 52.222.191.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i1.sndcdn.com/avatars-WnxO40ryvv3YEAte-Oq76Wg-t500x500.jpg
Requested by: Host: discord-gift.kro.kr
URL: http://discord-gift.kro.kr/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.191.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-191-31.ham50.r.cloudfront.net
Software: /
Resource Hash: fef81815692389ed380ddb522e3ec691d4a05db731961919a108cc2c2892e982

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://discord-gift.kro.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Tue, 02 Jan 2024 22:06:11 GMT
via: 1.1 2e44a3b2c1d0f478404fb20d9971a778.cloudfront.net (CloudFront)
x-amz-cf-pop: HAM50-C2
age: 709487
x-cache: Hit from cloudfront
access-control-allow-methods: GET
access-control-allow-origin: *
content-type: image/jpeg
cache-control: public,max-age=3350545
access-control-allow-headers: Accept, Accept-Encoding, Authorization, Content-Type, Origin
content-length: 10907
x-amz-cf-id: 2QMPzLBiEheB0aYJ4oVyDLeDQoyeCTdgDAfn-gZ0W6USo26UEbZ2gA==

GET
H2 404 0037pi1sppm71.png
i.redd.it/ 1 KB
2 KB 148ms
120ms Image
image/png 2a04:4e42:200::396
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.redd.it/0037pi1sppm71.png
Requested by: Host: discord-gift.kro.kr
URL: http://discord-gift.kro.kr/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 35a0932c61e09a8c1cad9eec75b67a03602056463ed210310d2a09cf0b002ed5

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://discord-gift.kro.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

x-canonical-filename-image-generation: 1
x-amz-version-id: null
via: 1.1 varnish, 1.1 varnish
date: Thu, 11 Jan 2024 03:10:58 GMT
last-modified: Thu, 06 Oct 2016 22:56:01 GMT
server: snooserv
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 1.0, "failure_fraction": 1.0}
etag: "f17b01901c752c1bb04928131d1661af"
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: image/png
accept-ranges: bytes
fastly-restarts: 2
content-length: 1048

GET
H2 200 alpine.min.js Show response
cdn.jsdelivr.net/gh/alpinejs/alpine@v2.x.x/dist/ 26 KB
9 KB 31ms
14ms Script
application/javascript 2606:4700::6810:5614
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/alpinejs/alpine@v2.x.x/dist/alpine.min.js

Requested by

Host: discord-gift.kro.kr
URL: http://discord-gift.kro.kr/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dfbc6f14aa1ece087d34da8e25c9bc329b4a6d3757f87748ca4b5319c8a01d7f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://discord-gift.kro.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 03:10:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 17263
x-jsd-version: 2.8.2
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230118-FRA
x-jsd-version-type: version
server: cloudflare
etag: W/"6969-PYk6WU7wXAXPX7qrRZSTVytMicQ"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZhX2kWKRTUPiD8zQdrxcm7F5bRzy0IGGVs9TtqheS66sV68opt0X87Wwhx%2FylfwLtiEt0V8gYVWkYa%2BdYhTWi5e8OoEH%2BkoTCheaVhtkt8FWIqC3yA%2FPZpwpXLJ8t4qcBxQOl0Tu9m0WnThr4vM%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 8439f841f9b13733-FRA

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Discord (Instant Messenger)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| Alpine

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://i.redd.it/0037pi1sppm71.png Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
discord-gift.kro.kr
i.redd.it
i1.sndcdn.com
unpkg.com
2606:4700::6810:5614
2606:4700::6810:7caf
2606:50c0:8001::153
2a04:4e42:200::396
52.222.191.31
35a0932c61e09a8c1cad9eec75b67a03602056463ed210310d2a09cf0b002ed5
b6ad97402eddb903e7a5d7a73ee47a679204efbdda4521a391cbad9df509b932
dfbc6f14aa1ece087d34da8e25c9bc329b4a6d3757f87748ca4b5319c8a01d7f
fe156e84a32dfdcf0dd9f2b7817451583e713259fbf0cbf2166846cdb2648563
fef81815692389ed380ddb522e3ec691d4a05db731961919a108cc2c2892e982

discord-gift.kro.kr Open in urlscan Pro 2606:50c0:8001::153 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

5 Requests

60 %HTTPS

80 %IPv6

5 Domains

5 Subdomains

5 IPs

1 Countries

323 kBTransfer

2976 kBSize

0 Cookies

1 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

discord-gift.kro.kr Open in urlscan Pro
2606:50c0:8001::153 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

60 %
HTTPS

80 %
IPv6

5
Domains

5
Subdomains

5
IPs

1
Countries

323 kB
Transfer

2976 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!