steamapi.xpaw.me Open in urlscan Pro
2a06:98c1:3121::3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://steamapi.xpaw.me/
Effective URL:
https://steamapi.xpaw.me/
Submission: On March 21 via api (March 21st 2023, 12:25:22 am UTC) from US — Scanned from NL

Summary HTTP 11 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 11 HTTP transactions. The main IP is 2a06:98c1:3121::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is steamapi.xpaw.me.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on March 21st 2023. Valid for: a year.

This is the only time steamapi.xpaw.me was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Steam (Gaming)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2a06:98c1:312... 2a06:98c1:3120::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	2

1 2a06:98c1:3120::3 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

steamapi.xpaw.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)

steamapi.xpaw.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	xpaw.me 1 redirects steamapi.xpaw.me	121 KB
11	1

	Domain	Requested by
12	steamapi.xpaw.me	1 redirects steamapi.xpaw.me
11	1

This site contains links to these domains. Also see Links.

Domain
xpaw.me
steamcommunity.com
steamdb.info
github.com

Subject Issuer	Validity	Valid
steamapi.xpaw.me Cloudflare Inc ECC CA-3	`2023-03-21` - `2024-03-20`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://steamapi.xpaw.me/
Frame ID: 75D0912608859B133E6EA77C7EA95A83
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Steam Web API Documentation

Page URL History Show full URLs

http://steamapi.xpaw.me/ HTTP 301
https://steamapi.xpaw.me/ Page URL

Detected technologies

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+\sdata-v(?:ue)?-

Page Statistics

11
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

120 kB
Transfer

604 kB
Size

0
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://xpaw.me/
Title: xPaw

Search URL Search Domain Scan URL

URL: https://steamcommunity.com/dev/apikey
Title: Get your key here

Search URL Search Domain Scan URL

URL: https://steamdb.info/calculator/
Title: Get your id here

Search URL Search Domain Scan URL

URL: https://github.com/xPaw/SteamWebAPIDocumentation/blob/master/api_undocumented_methods.txt
Title: make a pull request to the file of undocumented APIs

Search URL Search Domain Scan URL

URL: https://github.com/xPaw/SteamWebAPIDocumentation
Title: is also available on GitHub

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://steamapi.xpaw.me/ HTTP 301
https://steamapi.xpaw.me/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
steamapi.xpaw.me/
Redirect Chain

http://steamapi.xpaw.me/
https://steamapi.xpaw.me/

2 KB
1 KB

111ms
63ms

Document
text/html

2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://steamapi.xpaw.me/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e51ab2ea978df4d45c290135d9f0be474df24a706f2f4381caf35c1f0668989b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: public, max-age=0, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 7ab20e8e3fce03ac-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Tue, 21 Mar 2023 00:25:17 GMT
link: <api.json>; rel="preload"; as=fetch, <documentation.js>; rel="preload"; as=script
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hT7OITy%2FhX00dg5Lu7NcymRRyQD4P%2FHtpciNQcsaCYoWyuLlG4UjJxklYSsWXbzWzf70Z9k%2FY%2B%2FIzku5v0cjPuMQRrKJ%2FXiqp71phf6UgRmZoCX%2FWYvo%2FCsy68ZNnmqKt0TphFAuJHd2e%2BL3Q%2B%2Bm"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff

Redirect headers

CF-RAY: 7ab20e8dbd4e3615-FRA
Cache-Control: max-age=3600
Connection: keep-alive
Date: Tue, 21 Mar 2023 00:25:17 GMT
Expires: Tue, 21 Mar 2023 01:25:17 GMT
Location: https://steamapi.xpaw.me/
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 api.json
steamapi.xpaw.me/ 295 KB
36 KB 59ms
56ms Other
application/json 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://steamapi.xpaw.me/api.json

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aae419385709696319b66a015d84d91295cc210619eb33762de809d8ea32fa27

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://steamapi.xpaw.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 21 Mar 2023 00:25:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"d3025ee45cdd671bcd89de460993b59e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RpHEVtITOugGN1D9WEnRue0b0BOaRt73opkiYLx7s77DUpM4qjw82%2BBtbtUVMftyE2nY9Ku8UQUqpxvMFxexG%2BdA3ZZXpyryLFSPJPBicwSdbNnDFrHpdEYYKI2WbmF2P6Bs088u7YlwRboOjzF8"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 7ab20e8eb85203ac-FRA

GET
H2 200 documentation.js Show response
steamapi.xpaw.me/ 103 KB
40 KB 36ms
35ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://steamapi.xpaw.me/documentation.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8edbbd21fcc9b15d84b6460a27fd8208fe9d515fc31118c03bfd52c71ec4f972

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://steamapi.xpaw.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 21 Mar 2023 00:25:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 0
cf-polished: origSize=105145
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"51cae76446b1d9850e7c951cb217e484"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zkIQrcqU5Jv7BiV1srVKevP0bW%2BsNbRG8HpbHXnl8qwvIgWShwUdc2fEbH6q74ss8gusFUKmtmIZa4eeMPywq2bjrbG6FlwqkeCNdaaG5WaXaaf7wvmMoszvmPcesisZAa9A"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 7ab20e8eb85903ac-FRA

GET
H2 200 style.css
steamapi.xpaw.me/ 196 KB
31 KB 48ms
47ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://steamapi.xpaw.me/style.css

Requested by

Host: steamapi.xpaw.me
URL: https://steamapi.xpaw.me/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

46ae046e7b491892e8b3d724d9fbf6cc9b4e60f474fa907ce5e03dfae15092f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 21 Mar 2023 00:25:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"667e732df9c6377cfb89ca9caadc5530"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9qKMnZgM36a4BcK7YLKe7D9G%2FvXzsI6Bw5c48yVHpQthUoNTd1wE%2B2L0%2BzaOQaENkILKcOG8IfZEKUkzRI2FUceRdJ3bdD0PklvIlmFjLc2k3bio4Vm1I3w1HCqxDS0b%2BmaO"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 7ab20e8eb85603ac-FRA

GET
H3 200 steam.jpg
steamapi.xpaw.me/icons/ 1 KB
2 KB 44ms
44ms Image
image/jpeg 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://steamapi.xpaw.me/icons/steam.jpg

Requested by

Host: steamapi.xpaw.me
URL: https://steamapi.xpaw.me/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0da7b1fe4fc9f33ef174cb9080d42c4c0edc39523c55a61edf342441950ff898

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 21 Mar 2023 00:25:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1446
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: "1fd8088062632550d04c67188d6a2c5c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1eHwHCJjwXLzJ4yDk8RLBlUMM%2B5zKSgNBu%2BtrAF%2FOfiH2VHCgHLHbGL%2BzPM2DSPoidaYJuy4ps4fwX%2FIResZcFo2ahBHm5k2e1NOohnK4kLCp0wx9gFjWSMMn01tGHrZ7J%2Fb8BrcydqTVM6YxQJF"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
accept-ranges: bytes
cf-ray: 7ab20e8f3a072bb2-FRA

GET
H3 200 csgo.jpg
steamapi.xpaw.me/icons/ 1 KB
2 KB 47ms
46ms Image
image/jpeg 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://steamapi.xpaw.me/icons/csgo.jpg

Requested by

Host: steamapi.xpaw.me
URL: https://steamapi.xpaw.me/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b13ba298064a23f96a0cae5c50b57347457cd3bba2c1f6c6ee05e4c8ca291f37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 21 Mar 2023 00:25:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1354
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: "62b875dd6f6eba73698cc269557fc391"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=07jIbKeDlWdU9ctMOcTmK2E8sNyyHnZLmwleTu188C0dZ1CbwXY9zGIdM3U7lpfgr0ePp8oyB4ro9m6qvTEibZvzPYd25hXV3pPMxPGypI8IrDTNGxmE9asYVbWD%2BhJw%2BeaVAEo9cEvoU%2BkOWYKU"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
accept-ranges: bytes
cf-ray: 7ab20e8f3a092bb2-FRA

GET
H3 200 dota.jpg
steamapi.xpaw.me/icons/ 1 KB
2 KB 45ms
44ms Image
image/jpeg 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://steamapi.xpaw.me/icons/dota.jpg

Requested by

Host: steamapi.xpaw.me
URL: https://steamapi.xpaw.me/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3520b13dd1a7954829eb15cd6abafce4f908ea5c624b9de40c25ccaeff74f87b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 21 Mar 2023 00:25:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1210
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: "16b7fc9fbaf530a3db4aa61877123c88"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9%2F14dmFTFoMd%2BmTtZI%2BoQncHz10%2FTS%2B8OYOdWy%2BfJXKFsbAneuLctWZfRENdNzxXDuoCOjg8tbmniWQXd6bJK%2B0eCdrXOIc9V4LoGtewhRpy1ZuQ%2FCIm2nFsByUB6mfoIug2"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
accept-ranges: bytes
cf-ray: 7ab20e8f3a0a2bb2-FRA

GET
H3 200 tf.jpg
steamapi.xpaw.me/icons/ 2 KB
3 KB 47ms
46ms Image
image/jpeg 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://steamapi.xpaw.me/icons/tf.jpg

Requested by

Host: steamapi.xpaw.me
URL: https://steamapi.xpaw.me/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

53648fe9b8c9e64ac7a756bc1a7931b6ea6524cafb7ad6a86ea0631c0c5bec42

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 21 Mar 2023 00:25:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2082
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: "34bd29119eb6342aa4e1ed73ad99e3ee"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JMK2DRLLTdBCS6a3EkPqJIkp30a%2FM9z0O7R%2Fc0nABADNl06Vwp%2BRRnfCmAvyoWisi78kh76cNrVfH5zPoEh6kvNwKtKFEoXb7vk827HESz3w%2F9hCC5euJkdkEabHi0%2FQWophPFr1viMw0Zhot4Of"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
accept-ranges: bytes
cf-ray: 7ab20e8f3a0b2bb2-FRA

GET
H3 200 portal2.jpg
steamapi.xpaw.me/icons/ 1 KB
2 KB 45ms
45ms Image
image/jpeg 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://steamapi.xpaw.me/icons/portal2.jpg

Requested by

Host: steamapi.xpaw.me
URL: https://steamapi.xpaw.me/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

70dab714bd3bea77707ff573e367087630a6ad3ab34af9eda9c01430b28f6c01

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 21 Mar 2023 00:25:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1246
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: "120a5448c38fc5b31a3066f48340147f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RHPjuTKh%2FqVOxQdogq5iqVotVimqoG9m62ZwQmtwuotm7lH6FMskMnuF1jz5fMz1e6cPEUpom6peRQvxqXq3p2YwWVoQ9bvoqmvjkO0aL6q0UsaALxU9WuL6MyrJLTLIJkCHUWX6tUW%2B7fvSOVgQ"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
accept-ranges: bytes
cf-ray: 7ab20e8f3a0c2bb2-FRA

GET
H3 200 underlords.jpg
steamapi.xpaw.me/icons/ 735 B
1 KB 63ms
63ms Image
image/jpeg 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://steamapi.xpaw.me/icons/underlords.jpg

Requested by

Host: steamapi.xpaw.me
URL: https://steamapi.xpaw.me/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3ac476a3190e1acf720674aab801f9d582dcb6335f37a38675f466f61a48b541

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 21 Mar 2023 00:25:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 735
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: "7dc36a78f6c105e2a644a6eaa4a7b5ce"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=75mMrsXD0vyiRvsxtXjdpENYqjKTr3fd27qNqd1QwkEtJg7tKAQ3kl1EDA9qz3OcZKJPGFRESdTUfCtKQGSIvxjsV8s1JSQXwbOlm9z8j%2FAIZtzcn3PoKW9x5QO9j%2Fq6XKOt"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
accept-ranges: bytes
cf-ray: 7ab20e8f3a0d2bb2-FRA

GET
H3 200 artifact.jpg
steamapi.xpaw.me/icons/ 959 B
1 KB 47ms
46ms Image
image/jpeg 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://steamapi.xpaw.me/icons/artifact.jpg

Requested by

Host: steamapi.xpaw.me
URL: https://steamapi.xpaw.me/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9b362f9ce1c4714362af349ad76bb048bc85a6c8f5428c38a936dec282e965f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 21 Mar 2023 00:25:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 959
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: "1ebaf3bdf0697be1ea11d083b7cbb79a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4%2F1F5E2Z1JE%2FplRRUysl9jAh0gUq7YWYTsV06%2FZTbKAyha82cCEbxvU73QOW7mrwI2S18GWR0s8YfYLwkzs0Afw%2BAphL%2FZ8m2lwCyjAGrm10ddSyshBCJ0ggGfa2Z2WwtwGi05SWmSVE9NxoZFSj"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
accept-ranges: bytes
cf-ray: 7ab20e8f3a0f2bb2-FRA

GET
DATA 200
OK truncated
/ 264 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ece2e95e0833a3ca202d786151532f388ff73be29ea66334534ed1fa597dfd7d

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 183 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d8c89b0459ec4d6069037002ff5d824395ff37dbf866bc4298fce22d336b182a

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Content-Type: image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Steam (Gaming)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless boolean| __VUE__

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

steamapi.xpaw.me
2a06:98c1:3120::3
2a06:98c1:3121::3
0da7b1fe4fc9f33ef174cb9080d42c4c0edc39523c55a61edf342441950ff898
3520b13dd1a7954829eb15cd6abafce4f908ea5c624b9de40c25ccaeff74f87b
3ac476a3190e1acf720674aab801f9d582dcb6335f37a38675f466f61a48b541
46ae046e7b491892e8b3d724d9fbf6cc9b4e60f474fa907ce5e03dfae15092f6
53648fe9b8c9e64ac7a756bc1a7931b6ea6524cafb7ad6a86ea0631c0c5bec42
70dab714bd3bea77707ff573e367087630a6ad3ab34af9eda9c01430b28f6c01
8edbbd21fcc9b15d84b6460a27fd8208fe9d515fc31118c03bfd52c71ec4f972
9b362f9ce1c4714362af349ad76bb048bc85a6c8f5428c38a936dec282e965f3
aae419385709696319b66a015d84d91295cc210619eb33762de809d8ea32fa27
b13ba298064a23f96a0cae5c50b57347457cd3bba2c1f6c6ee05e4c8ca291f37
d8c89b0459ec4d6069037002ff5d824395ff37dbf866bc4298fce22d336b182a
e51ab2ea978df4d45c290135d9f0be474df24a706f2f4381caf35c1f0668989b
ece2e95e0833a3ca202d786151532f388ff73be29ea66334534ed1fa597dfd7d

steamapi.xpaw.me Open in urlscan Pro 2a06:98c1:3121::3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

120 kBTransfer

604 kBSize

0 Cookies

5 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

steamapi.xpaw.me Open in urlscan Pro
2a06:98c1:3121::3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

120 kB
Transfer

604 kB
Size

0
Cookies

11 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!