steampowered-ticket.help Open in urlscan Pro
81.200.157.246 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://steampowered-ticket.help/
Submission Tags: phishingrod
Submission: On December 26 via api (December 26th 2023, 8:56:12 am UTC) from DE — Scanned from PL

Summary HTTP 21 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 21 HTTP transactions. The main IP is 81.200.157.246, located in Warsaw, Poland and belongs to ARTNET2, PL. The main domain is steampowered-ticket.help.
TLS certificate: Issued by R3 on December 25th 2023. Valid for: 3 months.

This is the only time steampowered-ticket.help was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Steam (Gaming)

Domain & IP information

	IP Address	AS Autonomous System
14	81.200.157.246 81.200.157.246	200088 (ARTNET2) (ARTNET2)
1	172.64.145.151 172.64.145.151	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	92.122.104.90 92.122.104.90	16625 (AKAMAI-AS) (AKAMAI-AS)
1	149.102.225.41 149.102.225.41	212238 (CDNEXT) (CDNEXT)
21	4

14 81.200.157.246 (Warsaw, Poland)

ASN200088 (ARTNET2, PL)
PTR: 2344847-cq90239.twc1.net

steampowered-ticket.help	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.64.145.151 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cloudflare.steamstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 92.122.104.90 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a92-122-104-90.deploy.static.akamaitechnologies.com

help.steampowered.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 149.102.225.41 (Los Angeles, United States)

ASN212238 (CDNEXT, GB)
PTR: unn-149-102-225-41.datapacket.com

overgreen.money	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	steampowered-ticket.help steampowered-ticket.help	498 KB
5	steampowered.com help.steampowered.com — Cisco Umbrella Rank: 43790	117 KB
1	overgreen.money overgreen.money	394 B
1	steamstatic.com cdn.cloudflare.steamstatic.com — Cisco Umbrella Rank: 14701	34 KB
21	4

	Domain	Requested by
14	steampowered-ticket.help	steampowered-ticket.help
5	help.steampowered.com	steampowered-ticket.help
1	overgreen.money	steampowered-ticket.help
1	cdn.cloudflare.steamstatic.com	steampowered-ticket.help
21	4

This site contains no links.

Subject Issuer	Validity	Valid
steampowered-ticket.help R3	`2023-12-25` - `2024-03-24`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-18` - `2024-05-17`	a year	crt.sh
store.steampowered.com DigiCert SHA2 Extended Validation Server CA	`2023-12-05` - `2024-12-05`	a year	crt.sh
overgreen.money R3	`2023-12-20` - `2024-03-19`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://steampowered-ticket.help/
Frame ID: D344E1C392BBFB2A2E02E2E10126F00B
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Steam Support - CS:2

Page Statistics

21
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

649 kB
Transfer

906 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
steampowered-ticket.help/ 17 KB
3 KB 130ms
38ms Document
text/html 81.200.157.246
ARTNET2

General

Check archive.org

Show headers Download Go to

Full URL: https://steampowered-ticket.help/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 81.200.157.246 Warsaw, Poland, ASN200088 (ARTNET2, PL),
Reverse DNS: 2344847-cq90239.twc1.net
Software: nginx/1.24.0 /
Resource Hash: 6521ad70433df34026ee0073b0a5ba1d73b3c9b8c4cec53180e7f864a7c38e56

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: pl-PL,pl;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 3218
Content-Type: text/html; charset=UTF-8
Date: Tue, 26 Dec 2023 08:56:07 GMT
ETag: "4533-60d58f495b900-gzip"
Last-Modified: Mon, 25 Dec 2023 17:32:52 GMT
Server: nginx/1.24.0
Vary: Accept-Encoding

GET
H/1.1 200
OK motiva_sans.css
steampowered-ticket.help/aboutme/ 2 KB
882 B 36ms
34ms Stylesheet
text/css 81.200.157.246
ARTNET2

General

Check archive.org

Show headers Download Go to

Full URL: https://steampowered-ticket.help/aboutme/motiva_sans.css
Requested by: Host: steampowered-ticket.help
URL: https://steampowered-ticket.help/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 81.200.157.246 Warsaw, Poland, ASN200088 (ARTNET2, PL),
Reverse DNS: 2344847-cq90239.twc1.net
Software: nginx/1.24.0 /
Resource Hash: 3339d1a5105301625790087bf08dc0a6e64bd6221a7c83d3ddfc0c8823c70330

Request headers

accept-language: pl-PL,pl;q=0.9
Referer: https://steampowered-ticket.help/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Tue, 26 Dec 2023 08:56:07 GMT
Content-Encoding: gzip
Last-Modified: Mon, 25 Dec 2023 17:35:30 GMT
Server: nginx/1.24.0
ETag: W/"6589bd62-8a6"
Transfer-Encoding: chunked
Content-Type: text/css
Connection: keep-alive

GET
H/1.1 200
OK buttons.css
steampowered-ticket.help/aboutme/ 13 KB
2 KB 74ms
37ms Stylesheet
text/css 81.200.157.246
ARTNET2

General

Check archive.org

Show headers Download Go to

Full URL: https://steampowered-ticket.help/aboutme/buttons.css
Requested by: Host: steampowered-ticket.help
URL: https://steampowered-ticket.help/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 81.200.157.246 Warsaw, Poland, ASN200088 (ARTNET2, PL),
Reverse DNS: 2344847-cq90239.twc1.net
Software: nginx/1.24.0 /
Resource Hash: 68208ab22cddf542edb6ecefeb31a487efd19a1fa4fb31b2407a233a82b36a26

Request headers

accept-language: pl-PL,pl;q=0.9
Referer: https://steampowered-ticket.help/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Tue, 26 Dec 2023 08:56:07 GMT
Content-Encoding: gzip
Last-Modified: Mon, 25 Dec 2023 17:31:30 GMT
Server: nginx/1.24.0
ETag: W/"6589bc72-33a6"
Transfer-Encoding: chunked
Content-Type: text/css
Connection: keep-alive

GET
H/1.1 200
OK shared_global.css
steampowered-ticket.help/aboutme/ 11 KB
4 KB 109ms
39ms Stylesheet
text/css 81.200.157.246
ARTNET2

General

Check archive.org

Show headers Download Go to

Full URL: https://steampowered-ticket.help/aboutme/shared_global.css
Requested by: Host: steampowered-ticket.help
URL: https://steampowered-ticket.help/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 81.200.157.246 Warsaw, Poland, ASN200088 (ARTNET2, PL),
Reverse DNS: 2344847-cq90239.twc1.net
Software: nginx/1.24.0 /
Resource Hash: 31e4fd3dcbc5418dd2304b8db15d59c0ecaac3e816168864f9f369ccacc385e2

Request headers

accept-language: pl-PL,pl;q=0.9
Referer: https://steampowered-ticket.help/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Tue, 26 Dec 2023 08:56:07 GMT
Content-Encoding: gzip
Last-Modified: Mon, 25 Dec 2023 17:25:06 GMT
Server: nginx/1.24.0
ETag: W/"6589baf2-2cf8"
Transfer-Encoding: chunked
Content-Type: text/css
Connection: keep-alive

GET
H/1.1 200
OK help.css
steampowered-ticket.help/aboutme/ 7 KB
3 KB 111ms
41ms Stylesheet
text/css 81.200.157.246
ARTNET2

General

Check archive.org

Show headers Download Go to

Full URL: https://steampowered-ticket.help/aboutme/help.css
Requested by: Host: steampowered-ticket.help
URL: https://steampowered-ticket.help/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 81.200.157.246 Warsaw, Poland, ASN200088 (ARTNET2, PL),
Reverse DNS: 2344847-cq90239.twc1.net
Software: nginx/1.24.0 /
Resource Hash: e4c6f3fb5e060fc7cb3f543ef8175b0fcd427fdc9deea1a467ce835e8255375c

Request headers

accept-language: pl-PL,pl;q=0.9
Referer: https://steampowered-ticket.help/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Tue, 26 Dec 2023 08:56:07 GMT
Content-Encoding: gzip
Last-Modified: Mon, 25 Dec 2023 17:24:18 GMT
Server: nginx/1.24.0
ETag: W/"6589bac2-1d05"
Transfer-Encoding: chunked
Content-Type: text/css
Connection: keep-alive

GET
H/1.1 200
OK shared_responsive.css
steampowered-ticket.help/aboutme/ 5 KB
2 KB 112ms
41ms Stylesheet
text/css 81.200.157.246
ARTNET2

General

Check archive.org

Show headers Download Go to

Full URL: https://steampowered-ticket.help/aboutme/shared_responsive.css
Requested by: Host: steampowered-ticket.help
URL: https://steampowered-ticket.help/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 81.200.157.246 Warsaw, Poland, ASN200088 (ARTNET2, PL),
Reverse DNS: 2344847-cq90239.twc1.net
Software: nginx/1.24.0 /
Resource Hash: 831617f58d6b51a4a752522db34cfe08233c23e28efa1e2b8f10286d318ea56e

Request headers

accept-language: pl-PL,pl;q=0.9
Referer: https://steampowered-ticket.help/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Tue, 26 Dec 2023 08:56:07 GMT
Content-Encoding: gzip
Last-Modified: Mon, 25 Dec 2023 17:25:20 GMT
Server: nginx/1.24.0
ETag: W/"6589bb00-13b7"
Transfer-Encoding: chunked
Content-Type: text/css
Connection: keep-alive

GET
H/1.1 200
OK logo_valve_footer.png
steampowered-ticket.help/aboutme/ 2 KB
2 KB 114ms
43ms Image
image/png 81.200.157.246
ARTNET2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://steampowered-ticket.help/aboutme/logo_valve_footer.png
Requested by: Host: steampowered-ticket.help
URL: https://steampowered-ticket.help/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 81.200.157.246 Warsaw, Poland, ASN200088 (ARTNET2, PL),
Reverse DNS: 2344847-cq90239.twc1.net
Software: nginx/1.24.0 /
Resource Hash: 8b97ba0dac22fe6704c1f6d95fe79613f33017804f256abb9006df0442491787

Request headers

accept-language: pl-PL,pl;q=0.9
Referer: https://steampowered-ticket.help/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Tue, 26 Dec 2023 08:56:07 GMT
Last-Modified: Tue, 02 May 2023 23:57:56 GMT
Server: nginx/1.24.0
ETag: "6451a384-736"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1846

GET
H/1.1 200
OK header_menu_hamburger.png
steampowered-ticket.help/aboutme/ 4 KB
4 KB 77ms
42ms Image
image/png 81.200.157.246
ARTNET2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://steampowered-ticket.help/aboutme/header_menu_hamburger.png
Requested by: Host: steampowered-ticket.help
URL: https://steampowered-ticket.help/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 81.200.157.246 Warsaw, Poland, ASN200088 (ARTNET2, PL),
Reverse DNS: 2344847-cq90239.twc1.net
Software: nginx/1.24.0 /
Resource Hash: fc9e6260a2706ae146282d77e67bc1b74688435f8912ab4c1932641eec28bffa

Request headers

accept-language: pl-PL,pl;q=0.9
Referer: https://steampowered-ticket.help/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Tue, 26 Dec 2023 08:56:07 GMT
Last-Modified: Tue, 02 May 2023 23:57:56 GMT
Server: nginx/1.24.0
ETag: "6451a384-ec1"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3777

GET
H/1.1 200
OK header_logo.png
steampowered-ticket.help/aboutme/ 11 KB
11 KB 41ms
41ms Image
image/png 81.200.157.246
ARTNET2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://steampowered-ticket.help/aboutme/header_logo.png
Requested by: Host: steampowered-ticket.help
URL: https://steampowered-ticket.help/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 81.200.157.246 Warsaw, Poland, ASN200088 (ARTNET2, PL),
Reverse DNS: 2344847-cq90239.twc1.net
Software: nginx/1.24.0 /
Resource Hash: 6cb869df089146c12efb5e9c968e911c314842624ba6f052a11346ac734cadc8

Request headers

accept-language: pl-PL,pl;q=0.9
Referer: https://steampowered-ticket.help/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Tue, 26 Dec 2023 08:56:07 GMT
Last-Modified: Tue, 02 May 2023 23:57:56 GMT
Server: nginx/1.24.0
ETag: "6451a384-2a6f"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 10863

GET
H/1.1 200
OK logo_steam.svg
steampowered-ticket.help/aboutme/ 4 KB
2 KB 38ms
38ms Image
image/svg+xml 81.200.157.246
ARTNET2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://steampowered-ticket.help/aboutme/logo_steam.svg
Requested by: Host: steampowered-ticket.help
URL: https://steampowered-ticket.help/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 81.200.157.246 Warsaw, Poland, ASN200088 (ARTNET2, PL),
Reverse DNS: 2344847-cq90239.twc1.net
Software: nginx/1.24.0 /
Resource Hash: c3a7c646a1305017f22423030cb5a12acc9f96b64013dcef7aeb80567b542cbb

Request headers

accept-language: pl-PL,pl;q=0.9
Referer: https://steampowered-ticket.help/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Tue, 26 Dec 2023 08:56:07 GMT
Content-Encoding: gzip
Last-Modified: Tue, 02 May 2023 23:57:56 GMT
Server: nginx/1.24.0
ETag: W/"6451a384-e64"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Connection: keep-alive

GET
H2 200 header.jpg
cdn.cloudflare.steamstatic.com/steam/apps/730/ 33 KB
34 KB 163ms
58ms Image
image/jpeg 172.64.145.151
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.cloudflare.steamstatic.com/steam/apps/730/header.jpg?t=1698860631
Requested by: Host: steampowered-ticket.help
URL: https://steampowered-ticket.help/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.145.151 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3d60645c8fdddc4bfe8a9e55dc1b4650311b2e8220f221908c8ef1cd94f067fa

Request headers

accept-language: pl-PL,pl;q=0.9
Referer: https://steampowered-ticket.help/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 08:56:07 GMT
cf-cache-status: HIT
cf-bgj: h2pri
last-modified: Mon, 18 Sep 2023 22:33:56 GMT
server: cloudflare
age: 534831
etag: "6508d054-85f8"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=604800, public
accept-ranges: bytes
cf-ray: 83b81bd788c59235-FRA
content-length: 34296
expires: Wed, 27 Dec 2023 02:02:48 GMT

GET
H/1.1 200
OK at1hzoa6sfye.js Show response
steampowered-ticket.help/ 326 KB
108 KB 80ms
78ms Script
application/javascript 81.200.157.246
ARTNET2

General

Check archive.org

Show headers Download Go to

Full URL: https://steampowered-ticket.help/at1hzoa6sfye.js
Requested by: Host: steampowered-ticket.help
URL: https://steampowered-ticket.help/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 81.200.157.246 Warsaw, Poland, ASN200088 (ARTNET2, PL),
Reverse DNS: 2344847-cq90239.twc1.net
Software: nginx/1.24.0 /
Resource Hash: eeb94f0cc335386630227c2832e42548f130ece774400832f4d540c4bcc1a867

Request headers

accept-language: pl-PL,pl;q=0.9
Referer: https://steampowered-ticket.help/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Tue, 26 Dec 2023 08:56:07 GMT
Content-Encoding: gzip
Last-Modified: Sun, 24 Dec 2023 12:24:48 GMT
Server: nginx/1.24.0
ETag: W/"65882310-519aa"
Transfer-Encoding: chunked
Content-Type: application/javascript; charset=utf-8
Connection: keep-alive

GET
H/1.1 200
OK blue_body_top.jpg
help.steampowered.com/public/images/ 50 KB
50 KB 338ms
212ms Image
image/jpeg 92.122.104.90
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://help.steampowered.com/public/images/blue_body_top.jpg?v=2
Requested by: Host: steampowered-ticket.help
URL: https://steampowered-ticket.help/aboutme/help.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 92.122.104.90 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-104-90.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: aeacbf69f083c220da60b8994c08cf8cd1505a62a0df5a7c0a9aa4f258bab1e7

Request headers

accept-language: pl-PL,pl;q=0.9
Referer: https://steampowered-ticket.help/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Tue, 26 Dec 2023 08:56:07 GMT
Last-Modified: Fri, 05 Jan 2018 22:34:40 GMT
Server: nginx
ETag: "5a4ffd80-c6c7"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 50887

GET
H/1.1 200
OK blue_body_repeat.jpg
help.steampowered.com/public/images/ 64 KB
64 KB 333ms
208ms Image
image/jpeg 92.122.104.90
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://help.steampowered.com/public/images/blue_body_repeat.jpg?v=2
Requested by: Host: steampowered-ticket.help
URL: https://steampowered-ticket.help/aboutme/help.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 92.122.104.90 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-104-90.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: b258176e6b291343c18679962ab8658108451a22f12a5aecab106501d8bc091e

Request headers

accept-language: pl-PL,pl;q=0.9
Referer: https://steampowered-ticket.help/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Tue, 26 Dec 2023 08:56:07 GMT
Last-Modified: Fri, 05 Jan 2018 22:34:40 GMT
Server: nginx
ETag: "5a4ffd80-100cf"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 65743

GET
H/1.1 200
OK btn_header_installsteam_download.png
help.steampowered.com/public/shared/images/header/ 291 B
595 B 338ms
208ms Image
image/png 92.122.104.90
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://help.steampowered.com/public/shared/images/header/btn_header_installsteam_download.png?v=1

Requested by

Host: steampowered-ticket.help
URL: https://steampowered-ticket.help/aboutme/shared_global.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.122.104.90 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-104-90.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

23341256db7f44b1f3811880fa2bae6b7748bbf6b62c544a162e38cf0d5c5082

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload

Request headers

accept-language: pl-PL,pl;q=0.9
Referer: https://steampowered-ticket.help/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Date: Tue, 26 Dec 2023 08:56:07 GMT
Last-Modified: Tue, 20 Mar 2018 23:40:39 GMT
Server: nginx
ETag: "5ab19bf7-123"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 291

GET
H/1.1 200
OK btn_arrow_down_padded.png
help.steampowered.com/public/shared/images/popups/ 161 B
464 B 332ms
209ms Image
image/png 92.122.104.90
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://help.steampowered.com/public/shared/images/popups/btn_arrow_down_padded.png

Requested by

Host: steampowered-ticket.help
URL: https://steampowered-ticket.help/aboutme/shared_global.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.122.104.90 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-104-90.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

93b1fbe4f6245b62bfd4c8c3347abe0fe67ed711315e59bfadaebc9873d8d9b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload

Request headers

accept-language: pl-PL,pl;q=0.9
Referer: https://steampowered-ticket.help/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Date: Tue, 26 Dec 2023 08:56:07 GMT
Last-Modified: Fri, 05 Jan 2018 22:35:04 GMT
Server: nginx
ETag: "5a4ffd98-a1"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 161

GET
H/1.1 200
OK arrow_right.png
help.steampowered.com/public/images/ 1 KB
1 KB 381ms
263ms Image
image/png 92.122.104.90
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://help.steampowered.com/public/images/arrow_right.png
Requested by: Host: steampowered-ticket.help
URL: https://steampowered-ticket.help/aboutme/help.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 92.122.104.90 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-104-90.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 18af5ae91365e0ef0d029cac6cd819377bc1daef5f4d55dbe9767c10c86adf29

Request headers

accept-language: pl-PL,pl;q=0.9
Referer: https://steampowered-ticket.help/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Tue, 26 Dec 2023 08:56:07 GMT
Last-Modified: Fri, 05 Jan 2018 22:34:40 GMT
Server: nginx
ETag: "5a4ffd80-448"
Content-Type: image/png
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1096

GET
H/1.1 200
OK MotivaSans-Thin.ttf
steampowered-ticket.help/aboutme/ 116 KB
116 KB 46ms
46ms Font
application/font-sfnt 81.200.157.246
ARTNET2

General

Check archive.org

Show headers Download Go to

Full URL: https://steampowered-ticket.help/aboutme/MotivaSans-Thin.ttf?v=4.015
Requested by: Host: steampowered-ticket.help
URL: https://steampowered-ticket.help/aboutme/motiva_sans.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 81.200.157.246 Warsaw, Poland, ASN200088 (ARTNET2, PL),
Reverse DNS: 2344847-cq90239.twc1.net
Software: nginx/1.24.0 /
Resource Hash: 0adf4d5edbc82d28879fdfaaf7274ba05162ff8cbbda816d69ed52f1dae547f6

Request headers

Referer: https://steampowered-ticket.help/aboutme/motiva_sans.css
Origin: https://steampowered-ticket.help
accept-language: pl-PL,pl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Tue, 26 Dec 2023 08:56:07 GMT
Last-Modified: Mon, 25 Dec 2023 17:36:02 GMT
Server: nginx/1.24.0
ETag: "1cfd0-60d58ffe8e480"
Content-Type: application/font-sfnt
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 118736

GET
H/1.1 200
OK MotivaSans-Light.ttf
steampowered-ticket.help/aboutme/ 120 KB
120 KB 86ms
85ms Font
application/font-sfnt 81.200.157.246
ARTNET2

General

Check archive.org

Show headers Download Go to

Full URL: https://steampowered-ticket.help/aboutme/MotivaSans-Light.ttf?v=4.015
Requested by: Host: steampowered-ticket.help
URL: https://steampowered-ticket.help/aboutme/motiva_sans.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 81.200.157.246 Warsaw, Poland, ASN200088 (ARTNET2, PL),
Reverse DNS: 2344847-cq90239.twc1.net
Software: nginx/1.24.0 /
Resource Hash: 6b7a3177485c193a2e80be6269b6b12880e695a8b4349f49fccf87f9205badcc

Request headers

Referer: https://steampowered-ticket.help/aboutme/motiva_sans.css
Origin: https://steampowered-ticket.help
accept-language: pl-PL,pl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Tue, 26 Dec 2023 08:56:07 GMT
Last-Modified: Mon, 25 Dec 2023 17:36:22 GMT
Server: nginx/1.24.0
ETag: "1df24-60d59011a1180"
Content-Type: application/font-sfnt
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 122660

GET
H/1.1 200
OK MotivaSans-Regular.ttf
steampowered-ticket.help/aboutme/ 120 KB
120 KB 79ms
79ms Font
application/font-sfnt 81.200.157.246
ARTNET2

General

Check archive.org

Show headers Download Go to

Full URL: https://steampowered-ticket.help/aboutme/MotivaSans-Regular.ttf?v=4.015
Requested by: Host: steampowered-ticket.help
URL: https://steampowered-ticket.help/aboutme/motiva_sans.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 81.200.157.246 Warsaw, Poland, ASN200088 (ARTNET2, PL),
Reverse DNS: 2344847-cq90239.twc1.net
Software: nginx/1.24.0 /
Resource Hash: 19b8db163bcc51732457efa40911b4a422f297ff3cd566467d87eab93cef0c14

Request headers

Referer: https://steampowered-ticket.help/aboutme/motiva_sans.css
Origin: https://steampowered-ticket.help
accept-language: pl-PL,pl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Tue, 26 Dec 2023 08:56:07 GMT
Last-Modified: Mon, 25 Dec 2023 17:36:12 GMT
Server: nginx/1.24.0
ETag: "1df3c-60d5900817b00"
Content-Type: application/font-sfnt
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 122684

POST
H/1.1 200
OK dfdxuojdxogxlnvqknmbnnxpjrkaybohcwiaixwjduvkin Show response
overgreen.money/ 49 B
394 B 1535ms
679ms XHR
application/json 149.102.225.41
CDNEXT

General

Check archive.org

Show headers Download Go to

Full URL: https://overgreen.money/dfdxuojdxogxlnvqknmbnnxpjrkaybohcwiaixwjduvkin
Requested by: Host: steampowered-ticket.help
URL: https://steampowered-ticket.help/at1hzoa6sfye.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 149.102.225.41 Los Angeles, United States, ASN212238 (CDNEXT, GB),
Reverse DNS: unn-149-102-225-41.datapacket.com
Software: / Express
Resource Hash: b28743e6de130e07a10a9cc236153bbd8112b7e8b210151379121eebdf5f9a24

Request headers

Referer: https://steampowered-ticket.help/
accept-language: pl-PL,pl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Date: Tue, 26 Dec 2023 08:56:09 GMT
X-Powered-By: Express
ETag: W/"31-EKz+WJhvvuUMhlDImWdQDYRLpfg"
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 49
Keep-Alive: timeout=5

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Steam (Gaming)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| m0_0x2c06 function| m0_0x71b3 function| toggleA

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.cloudflare.steamstatic.com
help.steampowered.com
overgreen.money
steampowered-ticket.help
149.102.225.41
172.64.145.151
81.200.157.246
92.122.104.90
0adf4d5edbc82d28879fdfaaf7274ba05162ff8cbbda816d69ed52f1dae547f6
18af5ae91365e0ef0d029cac6cd819377bc1daef5f4d55dbe9767c10c86adf29
19b8db163bcc51732457efa40911b4a422f297ff3cd566467d87eab93cef0c14
23341256db7f44b1f3811880fa2bae6b7748bbf6b62c544a162e38cf0d5c5082
31e4fd3dcbc5418dd2304b8db15d59c0ecaac3e816168864f9f369ccacc385e2
3339d1a5105301625790087bf08dc0a6e64bd6221a7c83d3ddfc0c8823c70330
3d60645c8fdddc4bfe8a9e55dc1b4650311b2e8220f221908c8ef1cd94f067fa
6521ad70433df34026ee0073b0a5ba1d73b3c9b8c4cec53180e7f864a7c38e56
68208ab22cddf542edb6ecefeb31a487efd19a1fa4fb31b2407a233a82b36a26
6b7a3177485c193a2e80be6269b6b12880e695a8b4349f49fccf87f9205badcc
6cb869df089146c12efb5e9c968e911c314842624ba6f052a11346ac734cadc8
831617f58d6b51a4a752522db34cfe08233c23e28efa1e2b8f10286d318ea56e
8b97ba0dac22fe6704c1f6d95fe79613f33017804f256abb9006df0442491787
93b1fbe4f6245b62bfd4c8c3347abe0fe67ed711315e59bfadaebc9873d8d9b5
aeacbf69f083c220da60b8994c08cf8cd1505a62a0df5a7c0a9aa4f258bab1e7
b258176e6b291343c18679962ab8658108451a22f12a5aecab106501d8bc091e
b28743e6de130e07a10a9cc236153bbd8112b7e8b210151379121eebdf5f9a24
c3a7c646a1305017f22423030cb5a12acc9f96b64013dcef7aeb80567b542cbb
e4c6f3fb5e060fc7cb3f543ef8175b0fcd427fdc9deea1a467ce835e8255375c
eeb94f0cc335386630227c2832e42548f130ece774400832f4d540c4bcc1a867
fc9e6260a2706ae146282d77e67bc1b74688435f8912ab4c1932641eec28bffa

steampowered-ticket.help Open in urlscan Pro 81.200.157.246 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

21 Requests

100 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

649 kBTransfer

906 kBSize

0 Cookies

0 Outgoing links

Redirected requests

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

steampowered-ticket.help Open in urlscan Pro
81.200.157.246 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

21
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

649 kB
Transfer

906 kB
Size

0
Cookies

21 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!