urlscan.io logo urlscan.io
SecurityTrails logo

rustorias.net Open in urlscan Pro
2606:4700:3035::6815:39ba  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://rustorias.net/steam.html
Submission: On April 18 via manual from NL — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 11 HTTP transactions. The main IP is 2606:4700:3035::6815:39ba, located in United States and belongs to CLOUDFLARENET, US. The main domain is rustorias.net.
TLS certificate: Issued by GTS CA 1P5 on March 27th 2023. Valid for: 3 months.
This is the only time rustorias.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Steam (Gaming)

Domain & IP information

IP Address AS Autonomous System
11 2606:4700:303... 13335 (CLOUDFLAR...)
11 1
Apex Domain
Subdomains		 Transfer
11 rustorias.net
rustorias.net
328 KB
11 1
Domain Requested by
11 rustorias.net rustorias.net
11 1

This site contains no links.

Subject Issuer Validity Valid
*.rustorias.net
GTS CA 1P5		 2023-03-27 -
2023-06-25		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://rustorias.net/steam.html
Frame ID: 328CB164ABE216CCDBCE43185448BBB0
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Steam Community

Page Statistics

11
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

328 kB
Transfer

687 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request steam.html
rustorias.net/ 		468 B
681 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rustorias.net/steam.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6815:39ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e1677f300cc6543a912c98f8bd9ca545975ec5f91692f32140604c91494b89bd

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7b9c8dc37a060e74-AMS
content-encoding
br
content-type
text/html
date
Tue, 18 Apr 2023 11:26:36 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BJrgRZFRC%2Bx6ndUjn4PmGZF%2BYINYSQaxuE%2B0tYdJ4bp0FF3dqnI32TSY0j9%2BzKkUXQeCxbW9S5cMo0NY8D%2Br9%2Fz9EjZ1wVTaQ2A%2F5vUhTszf02JyZSJQNtST7cQ3jcKaoel%2Bc8mmRxXrrPRW"}],"group":"cf-nel","max_age":604800}
server
cloudflare
s.js
rustorias.net/assets/s/ 		536 KB
174 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rustorias.net/assets/s/s.js
Requested by
Host: rustorias.net
URL: https://rustorias.net/steam.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6815:39ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6120498916e1430571ec75eda25e0fea8687f4ab8212b6af5a359af8fb52ab66

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://rustorias.net/steam.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Tue, 18 Apr 2023 11:26:36 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 15 Mar 2023 07:28:52 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"641173b4-86051"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y%2BwmF7C%2FWsR2Q3LikkWUNgmDdhqEaVa4JHpR2YUvwLujkVN9cu9tr9jbW8Hz74GO%2FVDkjrvucjndXJxJD2gqY3zNyut%2FaS7WzwtFJ1e%2FV0V%2B1g8SZb6z1EosiQNQHTp%2Fi32sM64izYQ2GOai"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7b9c8dc4ebeb0e74-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
btn_header_installsteam_download.png
rustorias.net/assets/s/img/ 		291 B
766 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rustorias.net/assets/s/img/btn_header_installsteam_download.png
Requested by
Host: rustorias.net
URL: https://rustorias.net/steam.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::6815:39ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
23341256db7f44b1f3811880fa2bae6b7748bbf6b62c544a162e38cf0d5c5082

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://rustorias.net/steam.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Tue, 18 Apr 2023 11:26:37 GMT
cf-cache-status
MISS
last-modified
Wed, 15 Mar 2023 07:28:52 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"641173b4-123"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MysR43auUxntfbD76wBAyuuTcZRzTbirnlAWqZHJ1TavZZhJKUNlGewH0hIuOrBjIf9wU7KgByjtyJqPYCRIfaTF%2FIn8SNeg%2Bv4idDBUL8%2F1IGKLeHkn6nDsgQPbhk%2FYhRNbCoX2WPQbbTI9"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
7b9c8dca2bcc1b04-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
291
btn_arrow_down_padded.png
rustorias.net/assets/s/img/ 		161 B
670 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rustorias.net/assets/s/img/btn_arrow_down_padded.png
Requested by
Host: rustorias.net
URL: https://rustorias.net/steam.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::6815:39ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
93b1fbe4f6245b62bfd4c8c3347abe0fe67ed711315e59bfadaebc9873d8d9b5

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://rustorias.net/steam.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Tue, 18 Apr 2023 11:26:37 GMT
cf-cache-status
MISS
last-modified
Wed, 15 Mar 2023 07:28:52 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"641173b4-a1"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kWeVbAIBoDUrYKX3yYVYjfctngzS6sG0m2pN6CfyIdqX1GdWEDgwa2cn8gCgAwjj6AWii98oZhCObFVr8fGQrkAikfLQiu7t%2BmkD%2FPq8GbzqY6BkSMPcxxccz5DvUFsVVPWdJ0jOQ%2FmChIQV"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
7b9c8dca2bce1b04-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
161
MotivaSans-Regular.ttf
rustorias.net/assets/s/fonts/ 		120 KB
120 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://rustorias.net/assets/s/fonts/MotivaSans-Regular.ttf
Requested by
Host: rustorias.net
URL: https://rustorias.net/steam.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::6815:39ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
19b8db163bcc51732457efa40911b4a422f297ff3cd566467d87eab93cef0c14

Request headers

Referer
https://rustorias.net/steam.html
Origin
https://rustorias.net
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Tue, 18 Apr 2023 11:26:37 GMT
cf-cache-status
MISS
last-modified
Wed, 15 Mar 2023 07:28:52 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"641173b4-1df3c"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wn4Ne%2BOFDx7j6iRlGlD8b7ay30507DCUQlQ3N0C%2FWZ%2F09oXuSRYluqcnmNDovn%2BSz%2B0jLUh7DqiaEjGwovHin1oWfHeNDP%2BVf780YgFhx00eFiCkEBX7Tr9cSudUb1MB1WE%2FLwCHyRtkl6yR"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
7b9c8dca2bcf1b04-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
122684
header_menu_hamburger.png
rustorias.net/assets/s/img/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rustorias.net/assets/s/img/header_menu_hamburger.png
Requested by
Host: rustorias.net
URL: https://rustorias.net/steam.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::6815:39ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc9e6260a2706ae146282d77e67bc1b74688435f8912ab4c1932641eec28bffa

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://rustorias.net/steam.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Tue, 18 Apr 2023 11:26:37 GMT
cf-cache-status
MISS
last-modified
Wed, 15 Mar 2023 07:28:54 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"641173b6-ec1"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=33BRCvrOODcE1UXmU%2Bb%2BashmCt9t%2FZWFLBA%2Bjq0QBlzKpMxcbhuNqYZpnOJeMo8cp1tMRipdgM976SSvGYztuY8hFiF34%2B%2BZvHV4U%2FqVbjlA7uqwrLTsduqArNu3B3z4FZX7lNpkqGOx9M6D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
7b9c8dca3be01b04-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
3777
header_logo.png
rustorias.net/assets/s/img/ 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rustorias.net/assets/s/img/header_logo.png
Requested by
Host: rustorias.net
URL: https://rustorias.net/steam.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::6815:39ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6cb869df089146c12efb5e9c968e911c314842624ba6f052a11346ac734cadc8

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://rustorias.net/steam.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Tue, 18 Apr 2023 11:26:37 GMT
cf-cache-status
MISS
last-modified
Wed, 15 Mar 2023 07:28:52 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"641173b4-2a6f"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QvXUHYIAytdM9N2aER91niwqFYZQD2R2KLDrJGVADgLEjxxJE%2BEODELp6BhOU4Cnd%2FGcgI0ih0ygk0PwcKs2dLYs6nU4KEk1oJGy%2BSbFeNGb%2BrvS%2F7jTLfHnyR5UuMSP%2F8C0baMae5A2FDP4"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
7b9c8dca3be31b04-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
10863
logo_steam.svg
rustorias.net/assets/s/img/ 		4 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rustorias.net/assets/s/img/logo_steam.svg
Requested by
Host: rustorias.net
URL: https://rustorias.net/steam.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::6815:39ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c3a7c646a1305017f22423030cb5a12acc9f96b64013dcef7aeb80567b542cbb

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://rustorias.net/steam.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Tue, 18 Apr 2023 11:26:37 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 15 Mar 2023 07:28:54 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"641173b6-e64"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xg5Svo9JC3qSGGu0uqbEJIu3%2BQRgSiZCEPQQiI522MVM0yrkKsdJ%2FUxQJF%2BSWZvXhTfpPmjlUo2fwdQKYxf8KInhJwoouYBUHVRZs1z44HA2VgZXkuVoiSvocqVf8FBK5iQy04%2BIi7TiOzut"}],"group":"cf-nel","max_age":604800}
content-type
image/svg+xml
cache-control
max-age=14400
cf-ray
7b9c8dca3be41b04-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
sits_landing.png
rustorias.net/assets/s/img/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rustorias.net/assets/s/img/sits_landing.png
Requested by
Host: rustorias.net
URL: https://rustorias.net/steam.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::6815:39ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
483ed1c78b7394366985110fe15e4aaf941882427515e5dfe7f582827a15378c

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://rustorias.net/steam.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Tue, 18 Apr 2023 11:26:37 GMT
cf-cache-status
MISS
last-modified
Wed, 15 Mar 2023 07:28:52 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"641173b4-1547"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YwU%2BuNZsA81Y%2BC583s7QqFAlQOM2t4DHsNS14SXrGU4WFw%2FL2dqh5Vl5kpNiFzLYSLwn6h%2FaqlM5WkybHX9hJQhPIRex9BCRtLlwz3YoEL%2BwAUW0zQSnyWD0Te1YnjMBhoXOhOPT8hhRp8eW"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
7b9c8dca3be51b04-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
5447
throbber.gif
rustorias.net/assets/s/img/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rustorias.net/assets/s/img/throbber.gif
Requested by
Host: rustorias.net
URL: https://rustorias.net/steam.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::6815:39ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0c4d1b66cbed8c0ba7bfe1d047409e80b99684794ba66e9556503890eae17f2d

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://rustorias.net/steam.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Tue, 18 Apr 2023 11:26:37 GMT
cf-cache-status
MISS
last-modified
Wed, 15 Mar 2023 07:28:52 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"641173b4-c88"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c%2FW%2BPhBW1sdxTvenD3Q1ldpz%2B5DPsWLzO%2Fn43Jh1F6Ez%2BeGIqIEWnf6WX%2FsPgiswEGhN96biE0lwIS5Jwkd0PSSA7PmI8zsA8DzM1NG6ffmo3A7u0uxq76zzHxmqDf8SPOn0Exj28N4BxO%2BU"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
7b9c8dca3be71b04-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
3208
footerLogo_valve.png
rustorias.net/assets/s/img/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rustorias.net/assets/s/img/footerLogo_valve.png
Requested by
Host: rustorias.net
URL: https://rustorias.net/steam.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::6815:39ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ae9f6c61e25d15882bf57bde193d10d375bd315c9741cabda11d700fd1bb7dd1

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://rustorias.net/steam.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Tue, 18 Apr 2023 11:26:37 GMT
cf-cache-status
MISS
last-modified
Wed, 15 Mar 2023 07:28:52 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"641173b4-e99"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XDrP7XpdOSLhwmt9ZMPcR8wHpUiZ3961diH%2B%2Frkm%2BGOPnSAQm%2FxqPUZik4cZ3jwTwnNWKB88xnlb51PqvFZxF51kzJoPEjduNs0DezA0JaFS0SqK%2FoY4ccy4HDfbtDOkwe%2BUjIKkzRMEajvG"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
7b9c8dca3be91b04-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
3737

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Steam (Gaming)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless string| $fDomain string| $domainToLogin function| gj_0x3bf0 function| gj_0x2d78 function| $changeLanguage

0 Cookies