{"report_id":"0d159ac7-f0c7-4092-af97-b0ca2c804118","version":6,"status":"done","tags":[],"date":"2026-05-18T22:57:15Z","url":{"schema":"http","addr":"steamworkshop.download/download/view/2585122844","fqdn":"steamworkshop.download","domain":"steamworkshop.download","tld":"download"},"ip":{"addr":"145.239.59.140","port":0,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"final":{"url":{"schema":"http","addr":"steamworkshop.download/download/view/2585122844","fqdn":"steamworkshop.download","domain":"steamworkshop.download","tld":"download"},"title":"Major Experimentals - SteamWorkshop.download","dom":{"size":4513,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (754)","md5":"98fd7ea6c30d1d1b9c515474a24c23c8","sha1":"f1ae90cb0bb8df2a82628b5404899ff7a8be468b","sha256":"b8c971e8575fb7f812b4676759c2ed8e381ee8859744db1d72088f7b22c267b5","sha512":"534d1532a68845a2b10d915e971e91c0a42a8db3c176cf0fd22a1c4f53d71a4377eb5feb3027bc9b31c4fc62f1720e6dd37c923b519ee595051033f5e0b39ab4","ssdeep":"48:xHXppKu4hkVtQiGVOYJDwxdDwzDwu7k90mglDXc6I5vqjv1ipvMNDvceaIHUZw9Q:F/qkeDWDcD7kGX+0RdInIHNloTOfL0F5","tlshash":"d991a5df1849c81b2a06e180a3aea24cd1479e4bc706dcd1f5bd03ac77d5e89917275f","dom_hash":"domhash952293fe8f126b2bcc6e680fad3d5038","first_seen":"2026-05-18T22:57:17.759616Z","last_seen":"2026-05-18T22:57:17.759616Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"steamworkshop.download/download/view/2585122844","fqdn":"steamworkshop.download","domain":"steamworkshop.download","tld":"download"},"ip":{"addr":"145.239.59.140","port":0,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-22T22:57:15Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":7,"urlquery":0,"analyzer":1}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-05-18T22:56:56Z","timestamp":1779145016,"ip_dst":{"addr":"145.239.59.140","port":80,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"ip_src":{"addr":"Client IP","port":44908,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.download domain","source":"{\"timestamp\":\"2026-05-18T22:56:56.526943+0000\",\"flow_id\":91519733581548,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.3\",\"src_port\":44908,\"dest_ip\":\"145.239.59.140\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858677,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.download domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"steamworkshop.download\",\"url\":\"/download/view/2585122844\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":1252},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":7,\"bytes_toserver\":703,\"bytes_toclient\":5135,\"start\":\"2026-05-18T22:56:53.116460+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-05-18T22:56:56Z","timestamp":1779145016,"ip_dst":{"addr":"145.239.59.140","port":80,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"ip_src":{"addr":"Client IP","port":44908,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.download domain","source":"{\"timestamp\":\"2026-05-18T22:56:56.630596+0000\",\"flow_id\":91519733581548,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.3\",\"src_port\":44908,\"dest_ip\":\"145.239.59.140\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":1,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858677,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.download domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"steamworkshop.download\",\"url\":\"/css/style.css\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/css\",\"http_refer\":\"http://steamworkshop.download/download/view/2585122844\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":10,\"pkts_toclient\":9,\"bytes_toserver\":1487,\"bytes_toclient\":5505,\"start\":\"2026-05-18T22:56:53.116460+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-05-18T22:56:56Z","timestamp":1779145016,"ip_dst":{"addr":"145.239.59.140","port":80,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"ip_src":{"addr":"Client IP","port":44926,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.download domain","source":"{\"timestamp\":\"2026-05-18T22:56:56.655494+0000\",\"flow_id\":1247797944274877,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.3\",\"src_port\":44926,\"dest_ip\":\"145.239.59.140\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858677,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.download domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"steamworkshop.download\",\"url\":\"/js/jquery.js\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"application/javascript\",\"http_refer\":\"http://steamworkshop.download/download/view/2585122844\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":644,\"bytes_toclient\":461,\"start\":\"2026-05-18T22:56:56.610237+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-05-18T22:56:56Z","timestamp":1779145016,"ip_dst":{"addr":"145.239.59.140","port":80,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"ip_src":{"addr":"Client IP","port":44914,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.download domain","source":"{\"timestamp\":\"2026-05-18T22:56:56.656628+0000\",\"flow_id\":571808746590072,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.3\",\"src_port\":44914,\"dest_ip\":\"145.239.59.140\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858677,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.download domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"steamworkshop.download\",\"url\":\"/images/spacer.gif\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"image/gif\",\"http_refer\":\"http://steamworkshop.download/download/view/2585122844\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":671,\"bytes_toclient\":551,\"start\":\"2026-05-18T22:56:56.610168+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-05-18T22:56:56Z","timestamp":1779145016,"ip_dst":{"addr":"145.239.59.140","port":80,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"ip_src":{"addr":"Client IP","port":44908,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.download domain","source":"{\"timestamp\":\"2026-05-18T22:56:56.690275+0000\",\"flow_id\":91519733581548,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.3\",\"src_port\":44908,\"dest_ip\":\"145.239.59.140\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":2,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858677,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.download domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"steamworkshop.download\",\"url\":\"/images/sprite.png\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"image/png\",\"http_refer\":\"http://steamworkshop.download/css/style.css\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":15,\"pkts_toclient\":13,\"bytes_toserver\":2205,\"bytes_toclient\":9726,\"start\":\"2026-05-18T22:56:53.116460+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-05-18T22:56:56Z","timestamp":1779145016,"ip_dst":{"addr":"145.239.59.140","port":80,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"ip_src":{"addr":"Client IP","port":44914,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.download domain","source":"{\"timestamp\":\"2026-05-18T22:56:56.690841+0000\",\"flow_id\":571808746590072,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.3\",\"src_port\":44914,\"dest_ip\":\"145.239.59.140\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":1,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858677,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.download domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"steamworkshop.download\",\"url\":\"/images/logo.png\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"image/png\",\"http_refer\":\"http://steamworkshop.download/css/style.css\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":11584},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":7,\"pkts_toclient\":13,\"bytes_toserver\":1255,\"bytes_toclient\":12970,\"start\":\"2026-05-18T22:56:56.610168+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-05-18T22:56:56Z","timestamp":1779145016,"ip_dst":{"addr":"145.239.59.140","port":80,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"ip_src":{"addr":"Client IP","port":44926,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.download domain","source":"{\"timestamp\":\"2026-05-18T22:56:56.918069+0000\",\"flow_id\":1247797944274877,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.3\",\"src_port\":44926,\"dest_ip\":\"145.239.59.140\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":1,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858677,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.download domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"steamworkshop.download\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"image/vnd.microsoft.icon\",\"http_refer\":\"http://steamworkshop.download/download/view/2585122844\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":1150},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":50,\"pkts_toclient\":69,\"bytes_toserver\":4073,\"bytes_toclient\":100194,\"start\":\"2026-05-18T22:56:56.610237+0000\"}}"}],"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-18","alert":"Sinkholed","trigger":"steamworkshop.download","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"www.googletagmanager.com","ip":{"addr":"142.251.143.136","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2011-11-11","domain_rank":283,"first_seen":"2012-10-04T01:07:32Z","last_seen":"2026-05-17T22:25:57.974982Z","alert_count":0,"request_count":1,"received_data":471652,"sent_data":442,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"steamworkshop.download","ip":{"addr":"145.239.59.140","port":80,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"domain_registered":"2016-01-11","domain_rank":620405,"first_seen":"2016-01-12T11:11:16Z","last_seen":"2026-05-18T22:57:16.628211Z","alert_count":16,"request_count":8,"received_data":129931,"sent_data":3272,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.16.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.6.40","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Google Analytics","description":"Google Analytics is a free web analytics service that tracks and reports website traffic.","website":"https://google.com/analytics","common_platform_enumeration":"","icon":"Google Analytics.svg","categories":["Analytics"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]},{"fqdn":"images.steamusercontent.com","ip":{"addr":"23.36.76.161","port":443,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"domain_registered":"2014-12-04","domain_rank":202284,"first_seen":"2023-12-07T13:39:19Z","last_seen":"2026-05-11T21:09:37.805838Z","alert_count":0,"request_count":1,"received_data":580095,"sent_data":508,"comment":"","tags":null,"fingerprints":[{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"http","addr":"steamworkshop.download/download/view/2585122844","fqdn":"steamworkshop.download","domain":"steamworkshop.download","tld":"download"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"d2d7bdbd8a4357a6378d4de4578fe3ea","sha1":"e61330534ced1343df803f5e5227a054ad1c27db","sha256":"94815851266ec6ee8383958d5d5c9692ab397823879fa93651e9618691129296","sha512":"b934f9ae68faaad822b3b0e7d36b303e13340a4aa2b6dedf3a11c6a50fec7006a5b6a84bada3fe83cd1efef65e425e8e397f68655b79b6064b6407a8684c76ae","ssdeep":"","tlshash":"09c02b8c720e0c7442fb27008b3fb604b00232249cd47d314c1b23045d30e07d784810","size":153,"data":"","first_seen":"2025-06-01T22:54:24.184957Z","last_seen":"2026-05-18T22:57:17.799023Z","times_seen":14,"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-05-18T22:56:56Z","timestamp":1779145016,"ip_dst":{"addr":"145.239.59.140","port":80,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"ip_src":{"addr":"172.18.0.3","port":44908,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.download domain","source":"{\"timestamp\":\"2026-05-18T22:56:56.526943+0000\",\"flow_id\":91519733581548,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.3\",\"src_port\":44908,\"dest_ip\":\"145.239.59.140\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858677,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.download domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"steamworkshop.download\",\"url\":\"/download/view/2585122844\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":1252},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":7,\"bytes_toserver\":703,\"bytes_toclient\":5135,\"start\":\"2026-05-18T22:56:53.116460+0000\"}}"}],"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"steamworkshop.download/download/view/2585122844","fqdn":"steamworkshop.download","domain":"steamworkshop.download","tld":"download"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"3ca3d860274dc7c84c6fa60519aa1a97","sha1":"33a162848b25980a87558e4b5116d9e8761e36a6","sha256":"1ee3e0da35cf0b102a5fc0a031dd14eaffb3cfd32270f690b3b329d1baa6dee0","sha512":"9d45f7b099030a304b9e2421f3bb667d516c90d9874341a4dbd94b40a23df1184d615fda5ab203bf1e71cce7d7696b75770162acd31deb194b1f62d8fb4316be","ssdeep":"","tlshash":"80f08b9eb48481121133b2149f1e0009a027319f0149fc857b7d12fd9f6fe1c606768f","size":603,"data":"","first_seen":"2026-05-18T22:57:17.800352Z","last_seen":"2026-05-18T22:57:17.800352Z","times_seen":1,"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-05-18T22:56:56Z","timestamp":1779145016,"ip_dst":{"addr":"145.239.59.140","port":80,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"ip_src":{"addr":"172.18.0.3","port":44908,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.download domain","source":"{\"timestamp\":\"2026-05-18T22:56:56.526943+0000\",\"flow_id\":91519733581548,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.3\",\"src_port\":44908,\"dest_ip\":\"145.239.59.140\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858677,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.download domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"steamworkshop.download\",\"url\":\"/download/view/2585122844\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":1252},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":7,\"bytes_toserver\":703,\"bytes_toclient\":5135,\"start\":\"2026-05-18T22:56:53.116460+0000\"}}"}],"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"steamworkshop.download/js/jquery.js","fqdn":"steamworkshop.download","domain":"steamworkshop.download","tld":"download"},"ip":{"addr":"145.239.59.140","port":80,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"7c70e914106e35e7c2201b7467d36e4e","sha1":"443cf86484f5f3ed9799023f4bf3ac8ea25550db","sha256":"6a2b56992f1d9168e656a624b43aa80699d7f5ab08284479b443ba74a1a53666","sha512":"2e1b08da1fa95b8968c83269ea958958ed68ccabc6d930731d91d16ee3e96d8f6aa7a59d976e765beae4f63e72a87c6a066df4de6149674a9cdd2be4c04ecdee","ssdeep":"1536:sbRdUgxV11T5Je7evPJoHG9N5TTApILdoABzD4yff8qeLvHHEjam7pmXSBTncquT:GXruKN5HaObnNCVqPO","tlshash":"6c93e8d9b2d6716383b731b854af5107b136a8aa784c8c50f068d8e4be74e48907bf7d","size":93970,"data":"","first_seen":"2025-06-06T19:50:02.88689Z","last_seen":"2026-05-18T22:57:17.802838Z","times_seen":8,"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-05-18T22:56:56Z","timestamp":1779145016,"ip_dst":{"addr":"145.239.59.140","port":80,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"ip_src":{"addr":"172.18.0.3","port":44926,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.download domain","source":"{\"timestamp\":\"2026-05-18T22:56:56.655494+0000\",\"flow_id\":1247797944274877,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.3\",\"src_port\":44926,\"dest_ip\":\"145.239.59.140\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858677,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.download domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"steamworkshop.download\",\"url\":\"/js/jquery.js\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"application/javascript\",\"http_refer\":\"http://steamworkshop.download/download/view/2585122844\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":644,\"bytes_toclient\":461,\"start\":\"2026-05-18T22:56:56.610237+0000\"}}"}],"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=G-HYG53KW5Q9","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.251.143.136","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"9273a297b429ce911953f95c9c448c3e","sha1":"a78ea04a5e5a601dfde8bdd58a44ffff3c45136c","sha256":"a5dd55c307ec9daffc7183b78d9e8034d230cca121794381d02f927cd6c9a910","sha512":"c8dc7a4a05eff9acb39ceb1b6d74611b7f19c5db98a866e1bcd3ef653ca9c4559dc9803d9f3f655cfd4eee71302fdeb0c53b309cc237e142100f9e5ef3ebfc41","ssdeep":"6144:uIQ/jV4eRh5Idw4eyeosX3KUo6gXdA+c3sz0s:M4eRgdwOxtAo","tlshash":"efa418cdb3d674225396f478903f018ba57b28a2b44cc89af189cce42d7469a5277f7c","size":471048,"data":"","first_seen":"2026-05-18T22:57:16.499792Z","last_seen":"2026-05-18T22:57:17.792259Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"http","addr":"steamworkshop.download/images/logo.png","fqdn":"steamworkshop.download","domain":"steamworkshop.download","tld":"download"},"ip":{"addr":"145.239.59.140","port":80,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://steamworkshop.download/download/view/2585122844","date":"2026-05-18T22:56:56.668Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/logo.png HTTP/1.1\r\nHost: steamworkshop.download\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://steamworkshop.download/css/style.css\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.16.1\r\nDate: Mon, 18 May 2026 22:56:56 GMT\r\nContent-Type: image/png\r\nContent-Length: 21607\r\nLast-Modified: Sat, 08 Apr 2017 20:55:22 GMT\r\nConnection: keep-alive\r\nETag: \"58e94e3a-5467\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.16.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21607,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 508 x 80, 8-bit/color RGBA, non-interlaced","md5":"461a9f0795f525f9cd5a65e974bdab29","sha1":"b376374f335227781736293c87537511bcf03fb7","sha256":"a4f6d92dc8f06173aad656ffcdcf8685f3a63639f3edc3af134eb968cf6871b0","sha512":"39f257901f645e4ca404e1bf45d38d199d4f63386916a042959a78b354c9657d6044e7ace3523e2be1f6b7b661ca3f2adbea741f2300b03c0442dcffa7fd9a25","ssdeep":"384:CQBJJ9bhIEERAX9hXoKB2IVHkPmT9Zpib+E3/G5RT+Tm2wgETmdgo:hTJglo97B2DPFb+EvG+Tm2iTmCo","tlshash":"79a2cf3792a767340060463db8c7655d11c9f76afc235b1486747ee7302ed0e64abe36","first_seen":"2025-06-01T22:54:24.179684Z","last_seen":"2026-05-18T22:57:17.761254Z","times_seen":14,"resource_available":false,"data":null}},"time_used":48,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":24,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-05-18T22:56:56Z","timestamp":1779145016,"ip_dst":{"addr":"145.239.59.140","port":80,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"ip_src":{"addr":"172.18.0.3","port":44914,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.download domain","source":"{\"timestamp\":\"2026-05-18T22:56:56.690841+0000\",\"flow_id\":571808746590072,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.3\",\"src_port\":44914,\"dest_ip\":\"145.239.59.140\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":1,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858677,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.download domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"steamworkshop.download\",\"url\":\"/images/logo.png\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"image/png\",\"http_refer\":\"http://steamworkshop.download/css/style.css\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":11584},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":7,\"pkts_toclient\":13,\"bytes_toserver\":1255,\"bytes_toclient\":12970,\"start\":\"2026-05-18T22:56:56.610168+0000\"}}"}],"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-18","alert":"Sinkholed","trigger":"steamworkshop.download","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"steamworkshop.download/images/sprite.png","fqdn":"steamworkshop.download","domain":"steamworkshop.download","tld":"download"},"ip":{"addr":"145.239.59.140","port":80,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://steamworkshop.download/download/view/2585122844","date":"2026-05-18T22:56:56.670Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/sprite.png HTTP/1.1\r\nHost: steamworkshop.download\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://steamworkshop.download/css/style.css\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.16.1\r\nDate: Mon, 18 May 2026 22:56:56 GMT\r\nContent-Type: image/png\r\nContent-Length: 3325\r\nLast-Modified: Sat, 08 Apr 2017 20:55:22 GMT\r\nConnection: keep-alive\r\nETag: \"58e94e3a-cfd\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.16.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3325,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 3 x 458, 8-bit/color RGBA, non-interlaced","md5":"f1bae0d6c49b92789936b9e87f24cce9","sha1":"8414cd59e63378b265b8b9d5cdf689c682c83739","sha256":"eb9f3b38e821accae6339e318c5b86febc76592a9511c9ce70085e061ae74bee","sha512":"6d1b2e8d1172fd628a7b55f888716f81fba16fb3a9425ff5c027b612e1de295fa43abb74b980705ed966bc2204525ccbe973249bb447e5e59e20faa5d424f6fc","ssdeep":"","tlshash":"58616dab86e0a09eaa8d35510dcd8146e335122c4a133f3460d196cf5402e077f275b2","first_seen":"2023-06-18T10:01:01Z","last_seen":"2026-05-18T22:57:17.762157Z","times_seen":16,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-05-18T22:56:56Z","timestamp":1779145016,"ip_dst":{"addr":"145.239.59.140","port":80,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"ip_src":{"addr":"172.18.0.3","port":44908,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.download domain","source":"{\"timestamp\":\"2026-05-18T22:56:56.690275+0000\",\"flow_id\":91519733581548,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.3\",\"src_port\":44908,\"dest_ip\":\"145.239.59.140\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":2,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858677,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.download domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"steamworkshop.download\",\"url\":\"/images/sprite.png\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"image/png\",\"http_refer\":\"http://steamworkshop.download/css/style.css\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":15,\"pkts_toclient\":13,\"bytes_toserver\":2205,\"bytes_toclient\":9726,\"start\":\"2026-05-18T22:56:53.116460+0000\"}}"}],"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-18","alert":"Sinkholed","trigger":"steamworkshop.download","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamworkshop.download/download/view/2585122844","fqdn":"steamworkshop.download","domain":"steamworkshop.download","tld":"download"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-18T22:56:53.028Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /download/view/2585122844 HTTP/1.1\r\nHost: steamworkshop.download\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T02:24:27.635691Z","times_seen":17771271,"resource_available":true,"data":null}},"time_used":50,"timings":{"blocked":50,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-05-18T22:56:56Z","timestamp":1779145016,"ip_dst":{"addr":"145.239.59.140","port":80,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"ip_src":{"addr":"172.18.0.3","port":44908,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.download domain","source":"{\"timestamp\":\"2026-05-18T22:56:56.526943+0000\",\"flow_id\":91519733581548,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.3\",\"src_port\":44908,\"dest_ip\":\"145.239.59.140\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858677,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.download domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"steamworkshop.download\",\"url\":\"/download/view/2585122844\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":1252},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":7,\"bytes_toserver\":703,\"bytes_toclient\":5135,\"start\":\"2026-05-18T22:56:53.116460+0000\"}}"}],"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-18","alert":"Sinkholed","trigger":"steamworkshop.download","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"steamworkshop.download/download/view/2585122844","fqdn":"steamworkshop.download","domain":"steamworkshop.download","tld":"download"},"ip":{"addr":"145.239.59.140","port":80,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-18T22:56:53.116Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /download/view/2585122844 HTTP/1.1\r\nHost: steamworkshop.download\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.16.1\r\nDate: Mon, 18 May 2026 22:56:56 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.6.40\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.16.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:5.6.40","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Google Analytics","description":"Google Analytics is a free web analytics service that tracks and reports website traffic.","website":"https://google.com/analytics","common_platform_enumeration":"","icon":"Google Analytics.svg","categories":["Analytics"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":4456,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (745)","md5":"455ffa131314d52450b3cbedec2beba5","sha1":"e04676d3dcdb3da241e4e20f2619e0d64e3902a0","sha256":"943f06006eb2e42fb145f9a466cb486f4656d248acb871f433fca7f4d41bdcc2","sha512":"d5516931d83c50204a480b7553745785cdf27b233f39c835fa12fc095e52495736a41dbcd7c7c5527ca5c2a7ab465bcb1a9fc4188577f786aac6d211d914e4b3","ssdeep":"96:zrE0I4NjXDMDLsDeVJCeRhBenIxxlou/feE5Qg:z40r4XsSV4nIxxGuXj","tlshash":"179195df1c45c4163f029180a66ea64de0479d879207dcd0f1be13bca7d2b898176b5f","first_seen":"2026-05-18T22:57:17.773944Z","last_seen":"2026-05-18T22:57:17.773944Z","times_seen":1,"resource_available":false,"data":null}},"time_used":3432,"timings":{"blocked":22,"dns":0,"connect":22,"send":0,"wait":3388,"receive":0,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-05-18T22:56:56Z","timestamp":1779145016,"ip_dst":{"addr":"145.239.59.140","port":80,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"ip_src":{"addr":"172.18.0.3","port":44908,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.download domain","source":"{\"timestamp\":\"2026-05-18T22:56:56.526943+0000\",\"flow_id\":91519733581548,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.3\",\"src_port\":44908,\"dest_ip\":\"145.239.59.140\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858677,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.download domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"steamworkshop.download\",\"url\":\"/download/view/2585122844\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":1252},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":7,\"bytes_toserver\":703,\"bytes_toclient\":5135,\"start\":\"2026-05-18T22:56:53.116460+0000\"}}"}],"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-18","alert":"Sinkholed","trigger":"steamworkshop.download","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"steamworkshop.download/images/spacer.gif","fqdn":"steamworkshop.download","domain":"steamworkshop.download","tld":"download"},"ip":{"addr":"145.239.59.140","port":80,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://steamworkshop.download/download/view/2585122844","date":"2026-05-18T22:56:56.619Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/spacer.gif HTTP/1.1\r\nHost: steamworkshop.download\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://steamworkshop.download/download/view/2585122844\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.16.1\r\nDate: Mon, 18 May 2026 22:56:56 GMT\r\nContent-Type: image/gif\r\nContent-Length: 43\r\nLast-Modified: Sat, 08 Apr 2017 20:55:22 GMT\r\nConnection: keep-alive\r\nETag: \"58e94e3a-2b\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.16.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":43,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1 x 1","md5":"df3e567d6f16d040326c7a0ea29a4f41","sha1":"ea7df583983133b62712b5e73bffbcd45cc53736","sha256":"548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87","sha512":"b2ca25a3311dc42942e046eb1a27038b71d689925b7d6b3ebb4d7cd2c7b9a0c7de3d10175790ac060dc3f8acf3c1708c336626be06879097f4d0ecaa7f567041","ssdeep":"","tlshash":"c2900003caa08002c2a2c0300a0a03002f88a2300228030e80bc30acec3a3a22c02000","first_seen":"2023-04-05T03:49:37Z","last_seen":"2026-08-08T01:24:28.196657Z","times_seen":111023,"resource_available":true,"data":null}},"time_used":61,"timings":{"blocked":14,"dns":1,"connect":23,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-05-18T22:56:56Z","timestamp":1779145016,"ip_dst":{"addr":"145.239.59.140","port":80,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"ip_src":{"addr":"172.18.0.3","port":44914,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.download domain","source":"{\"timestamp\":\"2026-05-18T22:56:56.656628+0000\",\"flow_id\":571808746590072,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.3\",\"src_port\":44914,\"dest_ip\":\"145.239.59.140\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858677,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.download domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"steamworkshop.download\",\"url\":\"/images/spacer.gif\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"image/gif\",\"http_refer\":\"http://steamworkshop.download/download/view/2585122844\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":671,\"bytes_toclient\":551,\"start\":\"2026-05-18T22:56:56.610168+0000\"}}"}],"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-18","alert":"Sinkholed","trigger":"steamworkshop.download","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"images.steamusercontent.com/ugc/5976910200415163917/F00FA79865834FE8A4AA514C01F7A5477671A470/","fqdn":"images.steamusercontent.com","domain":"steamusercontent.com","tld":"com"},"ip":{"addr":"23.36.76.161","port":443,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://steamworkshop.download/download/view/2585122844","date":"2026-05-18T22:56:56.672Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"images.akamai.steamusercontent.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 13 Mar 2026 17:43:24 GMT","end":"Thu, 11 Jun 2026 17:43:23 GMT"},"fingerprint":{"sha1":"7F:71:B8:C0:EF:3F:CC:ED:5E:8B:CE:6B:9F:DB:F9:1A:D8:32:5F:71","sha256":"01:24:01:29:87:1B:56:09:A4:70:AA:83:BE:BD:8D:53:6C:00:69:22:6A:05:9A:2D:5E:B7:B3:69:46:FA:BC:96"}}},"request":{"raw":"GET /ugc/5976910200415163917/F00FA79865834FE8A4AA514C01F7A5477671A470/ HTTP/1.1\r\nHost: images.steamusercontent.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://steamworkshop.download/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Type: image/jpeg\r\nX-GUploader-UploadID: AAVLpEiBGZqOw7GU9hgQE-Fh0F8lNY_rJ-Wg-nMWRfSzfQzavIUAx_yjVT0b1SouBMNdj2nHzDUkvDE\r\nLast-Modified: Sun, 25 Feb 2024 21:51:16 GMT\r\nETag: \"b65146f6bec8e81348aacd847d010f69\"\r\nx-goog-generation: 1708897876852045\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 579176\r\nContent-Disposition: inline; filename*=UTF-8''previewfile_2585122844.jpg;\r\nx-goog-hash: crc32c=Q7DfEg==, md5=tlFG9r7I6BNIqs2EfQEPaQ==\r\nx-goog-storage-class: REGIONAL\r\nAccept-Ranges: bytes\r\nContent-Length: 579176\r\nAccess-Control-Expose-Headers: Authorization, Content-Length, Content-MD5, Content-Disposition, Date, Accept, Content-Type, origin\r\nServer: UploadServer\r\nCache-Control: private, max-age=584899\r\nExpires: Mon, 25 May 2026 17:25:15 GMT\r\nDate: Mon, 18 May 2026 22:56:56 GMT\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":579176,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1000x1000, components 3","md5":"b65146f6bec8e81348aacd847d010f69","sha1":"f00fa79865834fe8a4aa514c01f7a5477671a470","sha256":"5f36ef4c7f6aea7ab412ded9883aca215050443b5b90e4d928c708cc1e8ad553","sha512":"e299d5358e46a87bab12afbedcd4870eedc43b6f52a0fbf306d38aa0c3dce28c1edff434bef223e61814cae881c33248680e6a3cd76d486f26f6e9b06023b34c","ssdeep":"12288:NjCi2+ElYFfRCiIwQ3V96b1KQZwduoHGTKZIEIsyZb9VQPbSF603c:It+ElwJGwSb6bQQZwtGSIXsyp9ySG","tlshash":"3bc4235d7706a59412a830e730ea7b9b7874d82c66f4e01651bb0c14f47d2ef2cea3e9","first_seen":"2026-05-18T22:57:17.785486Z","last_seen":"2026-05-18T22:57:17.785486Z","times_seen":1,"resource_available":false,"data":null}},"time_used":235,"timings":{"blocked":99,"dns":85,"connect":1,"send":0,"wait":15,"receive":21,"ssl":13},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"steamworkshop.download/favicon.ico","fqdn":"steamworkshop.download","domain":"steamworkshop.download","tld":"download"},"ip":{"addr":"145.239.59.140","port":80,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://steamworkshop.download/download/view/2585122844","date":"2026-05-18T22:56:56.899Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: steamworkshop.download\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://steamworkshop.download/download/view/2585122844\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.16.1\r\nDate: Mon, 18 May 2026 22:56:56 GMT\r\nContent-Type: image/vnd.microsoft.icon\r\nContent-Length: 1150\r\nConnection: keep-alive\r\nLast-Modified: Sat, 08 Apr 2017 20:55:15 GMT\r\nETag: \"47e-54cadf57b8e90\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.16.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1150,"size_decoded":0,"mime_type":"image/vnd.microsoft.icon","magic":"MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel","md5":"6e44fc15cbe79482c209300ed99b8dd0","sha1":"8d53e27957bdb4e54670ad46b5bfc8015c1db24f","sha256":"607ea6e6883404c7f835e4e270d4d46036c72fe0e7cfee4edc7323bf3f7b3319","sha512":"f65fc938dfcef34d733f41da652f15e4c692a3228d0c31679adae62377717e03ab76184d48bd1b4a653ef0503667f411abbc3456655809f0a9e187d4404d1eb8","ssdeep":"","tlshash":"93213a109710c058e42093b1d219e1f4fb297f1a6db8c2cf118b7c33fa346744458ae4","first_seen":"2025-06-01T22:54:24.182711Z","last_seen":"2026-05-18T22:57:17.789205Z","times_seen":14,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-05-18T22:56:56Z","timestamp":1779145016,"ip_dst":{"addr":"145.239.59.140","port":80,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"ip_src":{"addr":"172.18.0.3","port":44926,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.download domain","source":"{\"timestamp\":\"2026-05-18T22:56:56.918069+0000\",\"flow_id\":1247797944274877,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.3\",\"src_port\":44926,\"dest_ip\":\"145.239.59.140\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":1,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858677,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.download domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"steamworkshop.download\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"image/vnd.microsoft.icon\",\"http_refer\":\"http://steamworkshop.download/download/view/2585122844\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":1150},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":50,\"pkts_toclient\":69,\"bytes_toserver\":4073,\"bytes_toclient\":100194,\"start\":\"2026-05-18T22:56:56.610237+0000\"}}"}],"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-18","alert":"Sinkholed","trigger":"steamworkshop.download","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"steamworkshop.download/css/style.css","fqdn":"steamworkshop.download","domain":"steamworkshop.download","tld":"download"},"ip":{"addr":"145.239.59.140","port":80,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://steamworkshop.download/download/view/2585122844","date":"2026-05-18T22:56:56.613Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /css/style.css HTTP/1.1\r\nHost: steamworkshop.download\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://steamworkshop.download/download/view/2585122844\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.16.1\r\nDate: Mon, 18 May 2026 22:56:56 GMT\r\nContent-Type: text/css\r\nContent-Length: 3718\r\nLast-Modified: Sat, 08 Apr 2017 20:55:21 GMT\r\nConnection: keep-alive\r\nETag: \"58e94e39-e86\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.16.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3718,"size_decoded":0,"mime_type":"text/css","magic":"assembler source, ASCII text, with very long lines (569)","md5":"10971ccf77b8583e487916344c2fd431","sha1":"7cd890e3a0aa649a79f46d751d6a18aa2eef1217","sha256":"b85bf08cd458e2b42cec1bc2597e8f59de0e07c33cc981b44200ddf21b08a700","sha512":"7e139a842a979d7e9e0a21389d6515472a3102e72177a651aef6906d4ab42e0e0ebd86bd9f75c6996d7d3125ab7c791bf4bc7bec4f8b33fe773b6de8b718fe1f","ssdeep":"","tlshash":"84713831d2841246fc27cc736561a79576348823c4134bf5efb53a74d78f2b62272755","first_seen":"2025-06-01T22:54:24.184073Z","last_seen":"2026-05-18T22:57:17.790896Z","times_seen":14,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-05-18T22:56:56Z","timestamp":1779145016,"ip_dst":{"addr":"145.239.59.140","port":80,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"ip_src":{"addr":"172.18.0.3","port":44908,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.download domain","source":"{\"timestamp\":\"2026-05-18T22:56:56.630596+0000\",\"flow_id\":91519733581548,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.3\",\"src_port\":44908,\"dest_ip\":\"145.239.59.140\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":1,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858677,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.download domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"steamworkshop.download\",\"url\":\"/css/style.css\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/css\",\"http_refer\":\"http://steamworkshop.download/download/view/2585122844\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":10,\"pkts_toclient\":9,\"bytes_toserver\":1487,\"bytes_toclient\":5505,\"start\":\"2026-05-18T22:56:53.116460+0000\"}}"}],"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-18","alert":"Sinkholed","trigger":"steamworkshop.download","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=G-HYG53KW5Q9","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.251.143.136","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://steamworkshop.download/download/view/2585122844","date":"2026-05-18T22:56:56.617Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google-analytics.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Apr 2026 08:35:05 GMT","end":"Mon, 13 Jul 2026 08:35:04 GMT"},"fingerprint":{"sha1":"E7:E4:62:10:D0:4A:34:4C:52:81:20:8A:19:37:09:AC:CB:16:42:54","sha256":"08:43:11:5A:D2:42:9C:49:2D:21:51:4F:92:B8:9E:59:04:F2:2D:E8:0F:ED:E7:49:06:D8:6F:61:B9:41:A2:36"}}},"request":{"raw":"GET /gtag/js?id=G-HYG53KW5Q9 HTTP/1.1\r\nHost: www.googletagmanager.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://steamworkshop.download/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: application/javascript; charset=UTF-8\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: Cache-Control\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Mon, 18 May 2026 22:56:56 GMT\r\nexpires: Mon, 18 May 2026 22:56:56 GMT\r\ncache-control: private, max-age=900\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncross-origin-resource-policy: cross-origin\r\nserver: Google Tag Manager\r\ncontent-length: 156706\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":471048,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (5929)","md5":"9273a297b429ce911953f95c9c448c3e","sha1":"a78ea04a5e5a601dfde8bdd58a44ffff3c45136c","sha256":"a5dd55c307ec9daffc7183b78d9e8034d230cca121794381d02f927cd6c9a910","sha512":"c8dc7a4a05eff9acb39ceb1b6d74611b7f19c5db98a866e1bcd3ef653ca9c4559dc9803d9f3f655cfd4eee71302fdeb0c53b309cc237e142100f9e5ef3ebfc41","ssdeep":"6144:uIQ/jV4eRh5Idw4eyeosX3KUo6gXdA+c3sz0s:M4eRgdwOxtAo","tlshash":"efa418cdb3d674225396f478903f018ba57b28a2b44cc89af189cce42d7469a5277f7c","first_seen":"2026-05-18T22:57:16.499792Z","last_seen":"2026-05-18T22:57:17.792259Z","times_seen":2,"resource_available":true,"data":null}},"time_used":325,"timings":{"blocked":110,"dns":0,"connect":21,"send":0,"wait":33,"receive":65,"ssl":94},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"steamworkshop.download/js/jquery.js","fqdn":"steamworkshop.download","domain":"steamworkshop.download","tld":"download"},"ip":{"addr":"145.239.59.140","port":80,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://steamworkshop.download/download/view/2585122844","date":"2026-05-18T22:56:56.620Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /js/jquery.js HTTP/1.1\r\nHost: steamworkshop.download\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://steamworkshop.download/download/view/2585122844\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.16.1\r\nDate: Mon, 18 May 2026 22:56:56 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 93968\r\nLast-Modified: Fri, 23 Mar 2018 13:20:31 GMT\r\nConnection: keep-alive\r\nETag: \"5ab4ff1f-16f10\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.16.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":93968,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (32769)","md5":"cc58f41c1a3db691070ef1d6d5c27110","sha1":"12adedcb0c87f6162e02e9d771d5cab32e44bc63","sha256":"a3545039a2ee191ebd57123acc54301caea2169e720a01cf3139d6f8c6ef014c","sha512":"42b8b1e1b9ab6e9eba77bba81e1e15e159974ec3fe329f7cc23dbdd11971fcc0562c2e4c05bb557e5018620087829e0061243056cc88cecb6be5e43163f117a0","ssdeep":"1536:sbRdUgxV11T56e7evPJoHG9N5TTApILdoABzD4yff8qeLvHHEjam7pmXSBTncquT:GXrRKN5HaObnNCVqPO","tlshash":"4193e8d9b2d6716383b731b854af5107b136a8aa784c8c50f068d8e4be74e48907bf7d","first_seen":"2023-08-14T14:55:13Z","last_seen":"2026-05-18T22:57:17.794456Z","times_seen":10,"resource_available":true,"data":null}},"time_used":127,"timings":{"blocked":13,"dns":0,"connect":23,"send":0,"wait":22,"receive":69,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-05-18T22:56:56Z","timestamp":1779145016,"ip_dst":{"addr":"145.239.59.140","port":80,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"ip_src":{"addr":"172.18.0.3","port":44926,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.download domain","source":"{\"timestamp\":\"2026-05-18T22:56:56.655494+0000\",\"flow_id\":1247797944274877,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.3\",\"src_port\":44926,\"dest_ip\":\"145.239.59.140\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858677,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.download domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"steamworkshop.download\",\"url\":\"/js/jquery.js\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"application/javascript\",\"http_refer\":\"http://steamworkshop.download/download/view/2585122844\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":0},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":644,\"bytes_toclient\":461,\"start\":\"2026-05-18T22:56:56.610237+0000\"}}"}],"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-18","alert":"Sinkholed","trigger":"steamworkshop.download","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}