gtm.you1.cn
Open in
urlscan Pro
47.57.186.72
Malicious Activity!
Public Scan
Submission: On August 22 via api from US — Scanned from DE
Summary
TLS certificate: Issued by Encryption Everywhere DV TLS CA - G2 on July 29th 2024. Valid for: 3 months.
This is the only time gtm.you1.cn was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Steam (Gaming)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
31 | 47.57.186.72 47.57.186.72 | 45102 (ALIBABA-C...) (ALIBABA-CN-NET Alibaba US Technology Co.) | |
1 | 2a02:26f0:170... 2a02:26f0:1700:6::17d5:a185 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 2a02:26f0:170... 2a02:26f0:1700:6::17d5:a191 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
33 | 3 |
ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN)
gtm.you1.cn |
ASN20940 (AKAMAI-ASN1, NL)
avatars.akamai.steamstatic.com |
ASN20940 (AKAMAI-ASN1, NL)
steamuserimages-a.akamaihd.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
31 |
you1.cn
gtm.you1.cn |
261 KB |
1 |
akamaihd.net
steamuserimages-a.akamaihd.net — Cisco Umbrella Rank: 13921 |
129 KB |
1 |
steamstatic.com
avatars.akamai.steamstatic.com — Cisco Umbrella Rank: 14032 |
2 KB |
33 | 3 |
Domain | Requested by | |
---|---|---|
31 | gtm.you1.cn |
gtm.you1.cn
|
1 | steamuserimages-a.akamaihd.net |
gtm.you1.cn
|
1 | avatars.akamai.steamstatic.com |
gtm.you1.cn
|
33 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
gtm.you1.cn Encryption Everywhere DV TLS CA - G2 |
2024-07-29 - 2024-10-27 |
3 months | crt.sh |
avatars.akamai.steamstatic.com R11 |
2024-08-15 - 2024-11-13 |
3 months | crt.sh |
a248.e.akamai.net DigiCert TLS RSA SHA256 2020 CA1 |
2024-04-18 - 2025-04-19 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://gtm.you1.cn/profiles/76561198177423277/screenshots?l=hungarian
Frame ID: 0586ECDDE58C0F8738DD02BECB847BA9
Requests: 33 HTTP requests in this frame
Screenshot
Detected technologies
Prototype (JavaScript Frameworks) ExpandDetected patterns
- (?:prototype|protoaculous)(?:-([\d.]*[\d]))?.*\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
script.aculo.us (JavaScript Libraries) Expand
Detected patterns
- /(?:scriptaculous|protoaculous)(?:\.js|/)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
33 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
screenshots
gtm.you1.cn/profiles/76561198177423277/ |
66 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
motiva_sans.css
gtm.you1.cn/public/shared/css/ |
2 KB 791 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
buttons.css
gtm.you1.cn/public/shared/css/ |
33 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
shared_global.css
gtm.you1.cn/public/shared/css/ |
84 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
globalv2.css
gtm.you1.cn/public/css/ |
38 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
profilev2.css
gtm.you1.cn/public/css/skin_1/ |
87 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
profile_sharedfiles.css
gtm.you1.cn/public/css/skin_1/ |
13 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sharedfiles_imagewall.css
gtm.you1.cn/public/css/skin_1/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
modalContent.css
gtm.you1.cn/public/css/skin_1/ |
2 KB 1014 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
shared_responsive.css
gtm.you1.cn/public/shared/css/ |
19 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
header.css
gtm.you1.cn/public/css/skin_1/ |
12 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
prototype-1.7.js
gtm.you1.cn/public/javascript/ |
165 KB 40 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
_combined.js
gtm.you1.cn/public/javascript/scriptaculous/ |
119 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
global.js
gtm.you1.cn/public/javascript/ |
101 KB 26 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-1.11.1.min.js
gtm.you1.cn/public/javascript/ |
94 KB 35 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tooltip.js
gtm.you1.cn/public/shared/javascript/ |
16 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
shared_global.js
gtm.you1.cn/public/shared/javascript/ |
48 KB 0 |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
infinitescroll.js
gtm.you1.cn/public/javascript/ |
3 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
modalv2.js
gtm.you1.cn/public/javascript/ |
4 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
modalContent.js
gtm.you1.cn/public/javascript/ |
14 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
screenshot_functions_v2.js
gtm.you1.cn/public/javascript/ |
6 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
shared_responsive_adapter.js
gtm.you1.cn/public/shared/javascript/ |
24 KB 7 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_valve_footer.png
gtm.you1.cn/public/shared/images/responsive/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
header_menu_hamburger.png
gtm.you1.cn/public/shared/images/responsive/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
header_logo.png
gtm.you1.cn/public/shared/images/responsive/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_steam.svg
gtm.you1.cn/public/shared/images/header/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
0c63c32f2292ff7ffbd408f096b0937cb04f54db_medium.jpg
avatars.akamai.steamstatic.com/ |
2 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
searchbox_workshop_submit.gif
gtm.you1.cn/public/images//sharedfiles/ |
1 KB 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
steamuserimages-a.akamaihd.net/ugc/2396564183544088606/6A86882011395AD3625EE5FA8A7109D7D5D24248/ |
128 KB 129 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
throbber.gif
gtm.you1.cn/public/images/login/ |
3 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
modalClose2.gif
gtm.you1.cn/public/images/skin_1/ |
305 B 361 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
warning_32.png
gtm.you1.cn/public/images/skin_1/ |
704 B 840 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
footerLogo_valve.png
gtm.you1.cn/public/images/skin_1/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Steam (Gaming)119 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| __PrototypePreserve object| Prototype object| Abstract object| Try object| Class function| PeriodicalExecuter function| Template object| $break object| Enumerable function| $A function| $w function| $H function| Hash function| $R function| ObjectRange object| Ajax function| $ object| Form object| Field function| $F object| Toggle object| Insertion object| $continue object| Position function| $$ function| Selector string| VALVE_PUBLIC_PATH object| Scriptaculous object| Effect object| Autocompleter object| Control object| Droppables object| Draggables function| Draggable function| SortableObserver object| Sortable function| RegisterSteamOnWebPanelShownHandler function| RegisterSteamOnWebPanelHiddenHandler function| RefreshNotificationArea function| vIE function| checkAbuseSub object| g_whiteListedDomains function| getHostname function| AlertNonSteamSite object| lastFilters function| FilterListFast function| requestFullScreen function| exitFullScreen function| RecordAJAXPageView string| g_strLanguage function| JoinImpressionsUpToLimit function| RecordAppImpression function| GetCookie function| SetCookie function| v_currencyformat function| IsCurrencySymbolBeforeValue function| IsCurrencyWholeUnits function| GetCurrencySymbol function| GetCurrencyCode function| GetAvatarURLFromHash function| ShowAbuseDialog function| StandardCommunityBan function| ReportProfile function| CEmoticonPopup function| PositionEmoticonHover function| InitEconomyHovers function| ShowTradeOffer function| Logout function| ChangeLanguage object| g_ContentDescriptorPreferences object| g_UGCWithNoBlur function| LoadUGCWithNoBlur function| SaveUGCWithNoBlur function| ApplyAdultContentPreferences function| ReapplyAdultContentPreferences function| EditContentDescriptors function| HandleRelatedContentDescriptors function| HandleNewDynamicLink function| UGCAdultContentPreferencesMenu function| ApplyAdultContentPreferencesHelper function| abuseSSDescripCheck function| BindOnHashChange function| CAutoSizingTextArea function| UpdateParameterInCurrentURL object| g_rgCommentThreads function| InitializeCommentThread function| BindCommentThreadSubscribeButtons function| FindCommentThread function| CCommentThread function| levenshtein function| TargetIsChild function| addEvent function| createQuery2 function| xHttpQuery_Post function| winDim function| getGoodElement function| addGameActions function| getPopPos function| tooltipCreate function| tooltipDestroy function| getElement function| setImage function| iSwapFullURL function| iSwap function| ListenToIFrameMessage function| ShowSharePublishedFilePopup function| ShowShareNewsPostPopup function| ShowShareClanAnnouncementPopup function| ShowSharePopup function| ShareOnSteam function| CloseShareOnSteamDialog function| ShareContentToUserStatus object| g_rgCurrencyData function| LocationHashObserver function| CGameSelector function| CGameSelectorWorkshopGames function| CGameSelectorOwnedGames function| CGameSelectorProfileShowcaseGames function| jQuery2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
gtm.you1.cn/ | Name: sessionid Value: 0f0819ea748a2a721cc0527e |
|
gtm.you1.cn/ | Name: steamCountry Value: HK%7C6fe94a0ae50456a3c0d45b2ae75bffe1 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host ; |
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
avatars.akamai.steamstatic.com
gtm.you1.cn
steamuserimages-a.akamaihd.net
2a02:26f0:1700:6::17d5:a185
2a02:26f0:1700:6::17d5:a191
47.57.186.72
0081ff4822c50da123cbac90f7c0b4118666845a2e250a70dd2e4e3c51466ba7
04f9f33ebdd11e6562d09abd1de5d5069e2eff0cfe8d6cdbdae6e83eb80f1204
06c92e650fe3d083e35792a50c42de69a3fa5143b91cab3588c3bdfa00ec8edb
0b71ce7901837a7fecfa92bc017f34bf69e6c04bd292083adf692d5c3a050248
0c4d1b66cbed8c0ba7bfe1d047409e80b99684794ba66e9556503890eae17f2d
13a528ccbea8400653fc0e1fa45d3c3e4c79ed994d2ec8193eb772e32ee802f0
13dc96a38051c7265fc09c2d6715c6a1b24dfa215ae7d05334db48844b3a1f5a
1befb2fc5af9ef88487c3a3a2b6689955e293dee75f7e4d2b9be6ce472374740
2a32f0d3f76080cffb6d8fcbf785f327c9eb8cd8c475857bf15cd4dd1f10ee8b
2d16a9d7621cd5247ddebd1928a919925d67f40a021fa34a88c2e6a152b886a7
522d1e31cc7725e86de4ec738fd77b33f93b822912aa3699b64b36e64f5e18a0
5cfc5e9cc0238b8222c62247cfa3a950e23085495e32a6e563a082f1893351ee
6cb869df089146c12efb5e9c968e911c314842624ba6f052a11346ac734cadc8
8b97ba0dac22fe6704c1f6d95fe79613f33017804f256abb9006df0442491787
91222f96f34735ebc88df208017e54d4329b9202e3e52367fb8b149698a1a5ef
92a217685eda5e8319d193142aeadf80ae7a9c9e04a9a365d9cf01078d459985
a581f45b4f07de460e1e2229312addd1e21fcb9fa66809557fc8e282821fc1ca
ae9f6c61e25d15882bf57bde193d10d375bd315c9741cabda11d700fd1bb7dd1
b174b82996bf83140e2038ca17d6d6134bdcb3250a1517beaffb13a2b887c6b5
ba4aad8eccbc515627ed0f8e3ce6876cc1a946eca26319ed3e8def9c73df7bc8
c2bd6e081d97168bf143442b564f073602797c4fafe3e9d6d880793936b36be7
c3a7c646a1305017f22423030cb5a12acc9f96b64013dcef7aeb80567b542cbb
d8bdea7fff893dbdbeaf6c2affec091a77483b9ec10e7958486bc3b6cc170c96
da0004805ea367edac7325d678a3eaa29a2d8e1a11ddbead78b54f55caca58bc
da708635da162ea493874627775c3520a42145b79c73bf787b5113bf87c0b27c
e22307bf09c5484500209edb91c734a92962194323ee4d9c81beda49a0db5d81
e2d4e0e1d3e162fdc815f16dfff9ae9b0a967949f0f3ae371f947d730a3f0661
e888e754e20a1b354bb45b59a05d7b281fee588a445854116b2bc84620fbf7f0
ecb79b1ea1675b180662b87e2eb7236ac5fe55ee3f37cbb5432202d3a17232a0
f51d4909d7ef0d048c77d062eb0666107b391ca894ef5acdfc84ce04cfc16a53
fc9e6260a2706ae146282d77e67bc1b74688435f8912ab4c1932641eec28bffa
ffbf8da80003dde0b87f6e88e44c815aa529f130e447c77ec82b0d6c3e0d2d17