{"report_id":"eea22de6-56e9-4c83-9a8f-3e1e702a3ea7","version":6,"status":"done","tags":[],"date":"2025-08-09T17:27:58Z","url":{"schema":"https","addr":"steamcommutnity.com/activation=oFJJbQqqxr","fqdn":"steamcommutnity.com","domain":"steamcommutnity.com","tld":"com"},"ip":{"addr":"62.60.226.160","port":0,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"final":{"url":{"schema":"https","addr":"steamcommutnity.com/activation=oFJJbQqqxr","fqdn":"steamcommutnity.com","domain":"steamcommutnity.com","tld":"com"},"title":"Summer Gift Marathon"},"submit":{"url":{"schema":"https","addr":"steamcommutnity.com/activation=oFJJbQqqxr","fqdn":"steamcommutnity.com","domain":"steamcommutnity.com","tld":"com"},"ip":{"addr":"62.60.226.160","port":0,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-09-13T17:27:58Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":0,"analyzer":0}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-08-09T17:27:36Z","timestamp":1754760456,"ip_dst":{"addr":"172.18.0.2","port":38970,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"62.60.226.160","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"severity":"medium","alert":"ET DROP Spamhaus DROP Listed Traffic Inbound group 8","source":"{\"timestamp\":\"2025-08-09T17:27:36.823552+0000\",\"flow_id\":236942692715676,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"62.60.226.160\",\"src_port\":443,\"dest_ip\":\"172.18.0.2\",\"dest_port\":38970,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.Evil\",\"ET.DROPIP\"]},\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2400007,\"rev\":4421,\"signature\":\"ET DROP Spamhaus DROP Listed Traffic Inbound group 8\",\"category\":\"Misc Attack\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Any\"],\"created_at\":[\"2010_12_30\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Minor\"],\"tag\":[\"Dshield\"],\"updated_at\":[\"2025_08_01\"]}},\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":1,\"bytes_toserver\":74,\"bytes_toclient\":74,\"start\":\"2025-08-09T17:27:36.789660+0000\"}}"}],"analyzer":null,"urlquery":null},"summary":[{"fqdn":"steamcommunity.com","ip":{"addr":"23.49.26.105","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"domain_registered":"2006-05-28","domain_rank":4728,"first_seen":"2014-03-11T13:45:34Z","last_seen":"2025-08-06T10:52:02.864518Z","alert_count":0,"request_count":1,"received_data":38823,"sent_data":404,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"steamcommutnity.com","ip":{"addr":"62.60.226.160","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"domain_registered":"2025-07-23","domain_rank":0,"first_seen":"2025-08-09T17:27:58.037739Z","last_seen":"2025-08-09T17:27:58.037739Z","alert_count":0,"request_count":1,"received_data":1737,"sent_data":509,"comment":"","tags":null,"fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-08-09T17:27:36Z","timestamp":1754760456,"ip_dst":{"addr":"172.18.0.2","port":38970,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"62.60.226.160","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"severity":"medium","alert":"ET DROP Spamhaus DROP Listed Traffic Inbound group 8","source":"{\"timestamp\":\"2025-08-09T17:27:36.823552+0000\",\"flow_id\":236942692715676,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"62.60.226.160\",\"src_port\":443,\"dest_ip\":\"172.18.0.2\",\"dest_port\":38970,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.Evil\",\"ET.DROPIP\"]},\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2400007,\"rev\":4421,\"signature\":\"ET DROP Spamhaus DROP Listed Traffic Inbound group 8\",\"category\":\"Misc Attack\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Any\"],\"created_at\":[\"2010_12_30\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Minor\"],\"tag\":[\"Dshield\"],\"updated_at\":[\"2025_08_01\"]}},\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":1,\"bytes_toserver\":74,\"bytes_toclient\":74,\"start\":\"2025-08-09T17:27:36.789660+0000\"}}"}]}],"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"steamcommunity.com/favicon.ico","fqdn":"steamcommunity.com","domain":"steamcommunity.com","tld":"com"},"ip":{"addr":"23.49.26.105","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://steamcommutnity.com/activation=oFJJbQqqxr","date":"2025-08-09T17:27:37.350Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"store.steampowered.com","organization":"Valve Corp"},"issuer":{"commonName":"DigiCert SHA2 Extended Validation Server CA","organization":"DigiCert Inc"},"validity":{"start":"Tue, 03 Dec 2024 00:00:00 GMT","end":"Wed, 03 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"E4:FD:E2:A8:17:27:D3:3D:CB:E2:28:F2:0C:59:A9:EE:52:2F:C4:70","sha256":"AF:63:1C:FA:99:69:D9:09:B2:CE:79:28:F9:0E:3C:04:CE:14:59:44:BE:03:E2:E6:EE:A6:E7:05:AF:7B:95:34"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: steamcommunity.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nContent-Type: image/x-icon\r\nCache-Control: public,max-age=86400\r\nExpires: Sun, 24 Nov 2024 13:55:33 GMT\r\nLast-Modified: Fri, 22 Nov 2024 18:31:38 GMT\r\nContent-Length: 38554\r\nDate: Sat, 09 Aug 2025 17:27:37 GMT\r\nConnection: keep-alive\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":38554,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel","md5":"231913fdebabcbe65f4b0052372bde56","sha1":"553909d080e4f210b64dc73292f3a111d5a0781f","sha256":"9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad","sha512":"7b11b709968c5a52b9b60189fb534f5df56912417243820e9d1c00c97f4bd6d0835f2cdf574d0c36ecb32dbbf5fc397324df54f7fdf9e1b062b5dbda2c02e919","ssdeep":"768:PcaDYrV5KBau+3erpKn9jpe7z9mWAFjQcR4D9DQ0LKfjLh:PcsiV5Y+erc9T/H4f0jLh","tlshash":"70038de82e4917aee9e2cf324adb6716237b4f88c0bc169742b07f193175a51c6d78c1","first_seen":"2023-04-05T07:02:49Z","last_seen":"2026-08-08T06:43:55.465699Z","times_seen":6881,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":3,"connect":1,"send":0,"wait":9,"receive":2,"ssl":9},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"steamcommutnity.com/activation=oFJJbQqqxr","fqdn":"steamcommutnity.com","domain":"steamcommutnity.com","tld":"com"},"ip":{"addr":"62.60.226.160","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-08-09T17:27:36.786Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"steamcommutnity.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Wed, 23 Jul 2025 19:53:14 GMT","end":"Tue, 21 Oct 2025 19:53:13 GMT"},"fingerprint":{"sha1":"2C:6D:27:EF:E6:B1:FB:06:33:F0:91:AA:92:3B:22:05:EC:DD:42:85","sha256":"76:25:F0:01:5B:BE:BF:B6:83:B5:32:BA:81:3F:52:39:27:FA:B3:00:A5:DB:4C:38:9A:A1:9A:F7:CB:F4:F9:6A"}}},"request":{"raw":"GET /activation=oFJJbQqqxr HTTP/1.1\r\nHost: steamcommutnity.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.18.0 (Ubuntu)\r\ndate: Sat, 09 Aug 2025 17:27:37 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nset-cookie: PHPSESSID=fjl8q4lddcbd6l0k1s8lb3jb4j; path=/; HttpOnly\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\naccess-control-allow-headers: *\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":1334,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (433)","md5":"e234eaf94fdc733dcd8e75f2adfb673b","sha1":"08400a3df2a1dd355fcdd3aac504f65481b1dddd","sha256":"8e9ad18aef8063b94fb126679f9a1f59909df235e8084c7c04cfdbd0600b8fd9","sha512":"436c7aa682fe55ef9b2e7629c9c271cc0b8ef58eced22e4f5c7b8e4dc4200520dc27fdf45424d865cd61ce1f2c0dc6f3009a817a9b9eac0bf089498fe891e818","ssdeep":"","tlshash":"c921c0f344a18037533780d129b6371d62f3954dd59a082577ee43ae0bd9f86e803104","first_seen":"2025-08-09T17:27:59.437883Z","last_seen":"2025-08-09T17:27:59.437883Z","times_seen":1,"resource_available":false,"data":null}},"time_used":503,"timings":{"blocked":78,"dns":8,"connect":34,"send":0,"wait":342,"receive":0,"ssl":38},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}