![](/screenshots/ff4a62be-f68d-4d37-bf65-2c29a1a8bd5f.png)
50-gift.com
Open in
urlscan Pro
2a06:98c1:3121::3
Malicious Activity!
Public Scan
Submission Tags: https://phish.report @phish_report Search All
Submission: On July 28 via api from FI — Scanned from NL
Summary
TLS certificate: Issued by GTS CA 1P5 on July 18th 2023. Valid for: 3 months.
This is the only time 50-gift.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Steam (Gaming)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
6 | 2a06:98c1:312... 2a06:98c1:3121::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700::68... 2606:4700::6810:5614 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 37.187.125.189 37.187.125.189 | 16276 (OVH) (OVH) | |
1 | 37.187.123.217 37.187.123.217 | 16276 (OVH) (OVH) | |
1 | 2001:4860:480... 2001:4860:4802:32::15 | 15169 (GOOGLE) (GOOGLE) | |
5 5 | 65.21.143.8 65.21.143.8 | 24940 (HETZNER-AS) (HETZNER-AS) | |
5 | 2606:4700:303... 2606:4700:3037::ac43:930f | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 176.9.19.26 176.9.19.26 | 24940 (HETZNER-AS) (HETZNER-AS) | |
17 | 7 |
ASN24940 (HETZNER-AS, DE)
PTR: static.26.19.9.176.clients.your-server.de
s12.gifyu.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
50-gift.com
50-gift.com |
51 KB |
5 |
yapx.cc
i.yapx.cc |
387 KB |
5 |
yapx.ru
5 redirects
i.yapx.ru |
1 KB |
2 |
wampi.ru
ic.wampi.ru im.wampi.ru |
72 KB |
2 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 372 |
48 KB |
1 |
gifyu.com
s12.gifyu.com — Cisco Umbrella Rank: 419397 |
1 MB |
1 |
svgur.com
svgur.com |
2 KB |
17 | 7 |
Domain | Requested by | |
---|---|---|
6 | 50-gift.com |
50-gift.com
|
5 | i.yapx.cc |
50-gift.com
|
5 | i.yapx.ru | 5 redirects |
2 | cdn.jsdelivr.net |
50-gift.com
|
1 | s12.gifyu.com |
50-gift.com
|
1 | svgur.com |
50-gift.com
|
1 | im.wampi.ru |
50-gift.com
|
1 | ic.wampi.ru |
50-gift.com
|
17 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
50-gift.com GTS CA 1P5 |
2023-07-18 - 2023-10-16 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-05-02 - 2024-05-01 |
a year | crt.sh |
ic.wampi.ru R3 |
2023-06-09 - 2023-09-07 |
3 months | crt.sh |
im.wampi.ru R3 |
2023-07-03 - 2023-10-01 |
3 months | crt.sh |
svgur.com GTS CA 1D4 |
2023-06-02 - 2023-08-31 |
3 months | crt.sh |
s12.gifyu.com R3 |
2023-06-13 - 2023-09-11 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://50-gift.com/1
Frame ID: 5C4241AF93DDB5F317223DCBA4750EB5
Requests: 7 HTTP requests in this frame
Frame:
https://50-gift.com/4p7qw5qy8pf/
Frame ID: C42AC1604D99BDA60F84A1B7AE663D5D
Requests: 10 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 10- https://i.yapx.ru/WTLY6.jpg HTTP 301
- https://i.yapx.cc/WTLY6.jpg
- https://i.yapx.ru/WTLY5.png HTTP 301
- https://i.yapx.cc/WTLY5.png
- https://i.yapx.ru/WTLY2.png HTTP 301
- https://i.yapx.cc/WTLY2.png
- https://i.yapx.ru/WTLY8.png HTTP 301
- https://i.yapx.cc/WTLY8.png
- https://i.yapx.ru/WTLY7.png HTTP 301
- https://i.yapx.cc/WTLY7.png
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
1
50-gift.com/ |
4 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
react.production.min.js
cdn.jsdelivr.net/npm/react@18.2.0/umd/ |
10 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
react-dom.production.min.js
cdn.jsdelivr.net/npm/react-dom@18.2.0/umd/ |
129 KB 43 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dbxywg37dtd.min.js
50-gift.com/assets/9g1a6nw5bdo/ |
20 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aaf36e26rw0rawf65v.css
50-gift.com/assets/61lgt1rmlgs/ |
5 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
/
50-gift.com/4p7qw5qy8pf/ Frame C42A |
37 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
/
50-gift.com/api/getsiteconfig/ |
675 B 908 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fcff4301rw0rawf65v.woff2
50-gift.com/assets/61lgt1rmlgs/ |
28 KB 29 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
header_menu_hamburger.png
ic.wampi.ru/2023/07/25/ Frame C42A |
36 KB 36 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
header_logo.png
im.wampi.ru/2023/07/25/ Frame C42A |
36 KB 36 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tkh.svg
svgur.com/i/ Frame C42A |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WTLY6.jpg
i.yapx.cc/ Frame C42A Redirect Chain
|
337 KB 337 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WTLY5.png
i.yapx.cc/ Frame C42A Redirect Chain
|
45 KB 45 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WTLY2.png
i.yapx.cc/ Frame C42A Redirect Chain
|
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WTLY8.png
i.yapx.cc/ Frame C42A Redirect Chain
|
291 B 584 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WTLY7.png
i.yapx.cc/ Frame C42A Redirect Chain
|
161 B 479 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SWtIF.gif
s12.gifyu.com/images/ Frame C42A |
1 MB 1 MB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Steam (Gaming)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| React object| ReactDOM function| doLanding function| doIFrame function| c function| D function| x object| fake_data object| triggers string| hash string| login_url2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
50-gift.com/ | Name: token Value: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJsaW5rX2lkIjoyNzkxODAsImlhdCI6MTY5MDU4NjE2MiwiZXhwIjoxNjkwNTg5NzYyfQ.3tsA5vyT1fTdlD3j6bQ8DwqrqbKFzQgwEsQec2fyx4g |
|
50-gift.com/ | Name: hash Value: 7u1 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
50-gift.com
cdn.jsdelivr.net
i.yapx.cc
i.yapx.ru
ic.wampi.ru
im.wampi.ru
s12.gifyu.com
svgur.com
176.9.19.26
2001:4860:4802:32::15
2606:4700:3037::ac43:930f
2606:4700::6810:5614
2a06:98c1:3121::3
37.187.123.217
37.187.125.189
65.21.143.8
06212bdd78e8b49de47eba4c08ed2be82e2e5edcf575a5a09b281a253c832324
2156cd65ee415d6be5a0bb68fd2e73abd51d2e18a09e2ada2c7472e24d801633
21758ed084cd0e37e735722ee4f3957ea960628a29dfa6c3ce1a1d47a2d6e4f7
23341256db7f44b1f3811880fa2bae6b7748bbf6b62c544a162e38cf0d5c5082
27245bf9456f5d6fe45504c36a0a9b1def4809654fbb321845e4551723318a92
2f0168503d6d8e8aa5a4cce7258ed43d913c0d2f252ff1b3f7f4385611bba36c
4b4969fa4ef3594324da2c6d78ce8766fbbc2fd121fff395aedf997db0a99a06
8b34342bff71952f24ffc857a5ee8aac03a9e3f409a204d003d61b32ae1614cb
93b1fbe4f6245b62bfd4c8c3347abe0fe67ed711315e59bfadaebc9873d8d9b5
aaf36e2663312feaf3fce36720156a7fd0b89b2fb0f1f110c1c17e07f2e15440
c3a7c646a1305017f22423030cb5a12acc9f96b64013dcef7aeb80567b542cbb
caae7de906ad7e5381d1ea55c53a66dd64e003497307fa7ac67bb01d4c77e9c5
d8bbe461137d50211568449468a1981ef189248200eadd48c3141a9df0b8f7fc
e9be250487d02bb9c9be24d8a2c9a61790d1ecf8980cd719b4c2b7692c6228a5
f24eaea3602615afe00a75ab86a4a59c4686c0b7c261665d8017cf50c986e44c
fcff4301dc083af2be2b990bb6485e9e06ce9d2b373a7acf8a74f61ea69d861a