steamcomnunltys.com Open in urlscan Pro
185.149.120.71  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response steamcomnunltys.com/	3 KB 2 KB	194ms 120ms	Document text/html	185.149.120.71 DDOS-GUARD
General Check archive.org Show headers Download Go to Full URL https://steamcomnunltys.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.149.120.71 , Russian Federation, ASN57724 (DDOS-GUARD, RU), Reverse DNS ddos-guard.net Software ddos-guard / Resource Hash 438ecfa6443ae5d7d322f479b8983abf69e463dd22954ccf249ea4e2d5568a8f Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept access-control-allow-origin * content-encoding gzip content-security-policy upgrade-insecure-requests; content-type text/html; charset=utf-8 date Sat, 30 Jul 2022 16:30:32 GMT server ddos-guard
GET H2	200	script.js Show response steamcomnunltys.com/54ea/	30 KB 15 KB	149ms 148ms	Script application/javascript	185.149.120.71 DDOS-GUARD
General Check archive.org Show headers Download Go to Full URL https://steamcomnunltys.com/54ea/script.js Requested by Host: steamcomnunltys.com URL: https://steamcomnunltys.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.149.120.71 , Russian Federation, ASN57724 (DDOS-GUARD, RU), Reverse DNS ddos-guard.net Software ddos-guard / Resource Hash 33dc40f5116e13b96ec14846ebafe1791c59674eee0ad16049466455c2b0abd6 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; Request headers accept-language de-DE,de;q=0.9 Referer https://steamcomnunltys.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 Response headers access-control-allow-origin * content-security-policy upgrade-insecure-requests; content-encoding gzip date Sat, 30 Jul 2022 16:30:32 GMT server ddos-guard access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept content-type application/javascript; charset=UTF-8
GET H2	200	/ Show response steamcomnunltys.com/54ea/openid/	50 KB 15 KB	124ms 123ms	Fetch text/html	185.149.120.71 DDOS-GUARD
General Check archive.org Show headers Download Go to Full URL https://steamcomnunltys.com/54ea/openid/ Requested by Host: steamcomnunltys.com URL: https://steamcomnunltys.com/54ea/script.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.149.120.71 , Russian Federation, ASN57724 (DDOS-GUARD, RU), Reverse DNS ddos-guard.net Software ddos-guard / Resource Hash 2369b762e591f414db7f46572e26961119262a3d6c08318e1198f5c3e44d2ca0 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; Request headers accept-language de-DE,de;q=0.9 Referer https://steamcomnunltys.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 Response headers content-security-policy upgrade-insecure-requests; content-encoding gzip server ddos-guard etag W/"c9d5-F00Yw0CM2JiSsD4F0r0WNdAMeMA" content-type text/html; charset=utf-8 access-control-allow-origin * date Sat, 30 Jul 2022 16:30:32 GMT access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept
POST H2	200	/ Show response steamcomnunltys.com/	16 B 338 B	78ms 77ms	Fetch application/json	185.149.120.71 DDOS-GUARD
General Check archive.org Show headers Download Go to Full URL https://steamcomnunltys.com/ Requested by Host: steamcomnunltys.com URL: https://steamcomnunltys.com/54ea/script.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.149.120.71 , Russian Federation, ASN57724 (DDOS-GUARD, RU), Reverse DNS ddos-guard.net Software ddos-guard / Resource Hash c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; Request headers Referer https://steamcomnunltys.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 Content-Type application/json Response headers content-security-policy upgrade-insecure-requests; server ddos-guard etag W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" content-type application/json; charset=utf-8 access-control-allow-origin * date Sat, 30 Jul 2022 16:30:32 GMT access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept content-length 16

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| makeAuthOnClick object| authSettings function| v function| m function| postXHR function| openAuth function| doStat function| S function| h

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.steamcomnunltys.com/	1970-01-20 13:38:54	Name: __ddg1_ Value: oSTYea38JyxAffZf6Of9
			steamcomnunltys.com/	1969-12-31 23:59:59	Name: session Value: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJsaW5rSUQiOjMzMjk3LCJvd25lciI6MTM3NSwiZG9tYWluSUQiOjY2MjcsImRvbWFpbiI6InN0ZWFtY29tbnVubHR5cy5jb20iLCJwYXRoIjoiIiwicmVhbElwIjoiODQuMTkuMTc1LjE4NCIsImlhdCI6MTY1OTE5ODYzMiwiZmFrZV92aXNpdCI6dHJ1ZX0.w_3SJPdlbEOEy7M2JBXbuI3lGuCsp-vvJo86OqNuf4Y

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests;

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

steamcomnunltys.com
185.149.120.71
2369b762e591f414db7f46572e26961119262a3d6c08318e1198f5c3e44d2ca0
33dc40f5116e13b96ec14846ebafe1791c59674eee0ad16049466455c2b0abd6
438ecfa6443ae5d7d322f479b8983abf69e463dd22954ccf249ea4e2d5568a8f
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97