{
  "type": "Domain",
  "indicator": "steamcommunitiny.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/steamcommunitiny.com",
    "alexa": "http://www.alexa.com/siteinfo/steamcommunitiny.com",
    "indicator": "steamcommunitiny.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3640326657,
      "indicator": "steamcommunitiny.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "6855ae943f355ff6dde0d14a",
          "name": "Steam Phishing: Popular as Ever",
          "description": "A recent phishing campaign targeting Steam users has been identified, involving deceptive messages sent through the platform's Friends list. The attackers use fraudulent URLs that closely mimic Steam's official domain, directing users to a fake 'Summer Gift Marathon' page. Upon logging in, users' credentials are stolen, potentially leading to further phishing attacks and theft of inventory items. The blog post lists numerous similar phishing domains and provides tips for users to stay safe, including only logging in through the legitimate Steam website, being cautious of unexpected messages with links, and using tools like URLscan.io and VirusTotal to check suspicious websites.",
          "modified": "2025-06-20T19:10:40.788000",
          "created": "2025-06-20T18:55:16.573000",
          "tags": [
            "social engineering",
            "gaming",
            "steam",
            "phishing",
            "credential theft",
            "cybersecurity",
            "fraud"
          ],
          "references": [
            "https://bartblaze.blogspot.com/2025/06/steam-phishing-popular-as-ever.html"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1185",
              "name": "Man in the Browser",
              "display_name": "T1185 - Man in the Browser"
            },
            {
              "id": "T1528",
              "name": "Steal Application Access Token",
              "display_name": "T1528 - Steal Application Access Token"
            },
            {
              "id": "T1534",
              "name": "Internal Spearphishing",
              "display_name": "T1534 - Internal Spearphishing"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 46,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "AlienVault",
            "id": "2",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png",
            "is_subscribed": true,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 31
          },
          "indicator_count": 31,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 386980,
          "modified_text": "347 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6341d1aa0a02a3f6251ab540",
          "name": "Sinking Yachts Phishing Domains",
          "description": "Sinking Yachts is a Discord based anti-phishing project founded by @nwunder. This project focuses on collecting and flagging domains that are running phishing scams against Discord or Steam, which are often spread with scam messages from compromised accounts. This collection mirrors the entire database and is updated in real time. Website: https://sinking.yachts API: https://phish.sinking.yachts Discord: https://discord.gg/cT6eQjWW8H (temporarily closed) Need to get in touch? Please email admin@fishfish.gg.",
          "modified": "2026-05-14T18:21:18.798000",
          "created": "2022-10-08T19:38:18.341000",
          "tags": [
            "discord",
            "roblox",
            "steam",
            "phishing"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "gaming"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 75566,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "__akac__",
            "id": "175104",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_175104/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 542,
            "hostname": 646
          },
          "indicator_count": 1188,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 521,
          "modified_text": "19 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 0
        },
        {
          "id": "69aefcc5d258300fb3e319e4",
          "name": "sinking yachts clone __akac__ ....",
          "description": "",
          "modified": "2026-05-14T18:21:18.798000",
          "created": "2026-03-09T17:00:53.305000",
          "tags": [
            "discord",
            "roblox",
            "steam",
            "phishing"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "gaming"
          ],
          "TLP": "white",
          "cloned_from": "6341d1aa0a02a3f6251ab540",
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 542,
            "hostname": 646
          },
          "indicator_count": 1188,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 73,
          "modified_text": "19 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 0
        },
        {
          "id": "69aefcc810c78c89c7f6bb87",
          "name": "sinking yachts clone __akac__ ....",
          "description": "",
          "modified": "2026-05-14T18:21:18.798000",
          "created": "2026-03-09T17:00:56.488000",
          "tags": [
            "discord",
            "roblox",
            "steam",
            "phishing"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "gaming"
          ],
          "TLP": "white",
          "cloned_from": "6341d1aa0a02a3f6251ab540",
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 542,
            "hostname": 647
          },
          "indicator_count": 1189,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 73,
          "modified_text": "19 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 0
        },
        {
          "id": "6785dccb041b628fde283705",
          "name": "phish.directory",
          "description": "phish.directory, a community-driven anti-phishing tool. Helping catch, prevent, and catalog phishing links & attempts.\n\nsee our website at https://phish.directory",
          "modified": "2026-01-25T18:05:17.629000",
          "created": "2025-01-14T03:40:59.456000",
          "tags": [
            "phishing",
            "scams",
            "steam",
            "discord",
            "roblox"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": true,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "jaspermayone",
            "id": "305022",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 41514,
            "hostname": 11318
          },
          "indicator_count": 52832,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 3,
          "modified_text": "128 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://bartblaze.blogspot.com/2025/06/steam-phishing-popular-as-ever.html"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [
            "Gaming"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "6855ae943f355ff6dde0d14a",
      "name": "Steam Phishing: Popular as Ever",
      "description": "A recent phishing campaign targeting Steam users has been identified, involving deceptive messages sent through the platform's Friends list. The attackers use fraudulent URLs that closely mimic Steam's official domain, directing users to a fake 'Summer Gift Marathon' page. Upon logging in, users' credentials are stolen, potentially leading to further phishing attacks and theft of inventory items. The blog post lists numerous similar phishing domains and provides tips for users to stay safe, including only logging in through the legitimate Steam website, being cautious of unexpected messages with links, and using tools like URLscan.io and VirusTotal to check suspicious websites.",
      "modified": "2025-06-20T19:10:40.788000",
      "created": "2025-06-20T18:55:16.573000",
      "tags": [
        "social engineering",
        "gaming",
        "steam",
        "phishing",
        "credential theft",
        "cybersecurity",
        "fraud"
      ],
      "references": [
        "https://bartblaze.blogspot.com/2025/06/steam-phishing-popular-as-ever.html"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1185",
          "name": "Man in the Browser",
          "display_name": "T1185 - Man in the Browser"
        },
        {
          "id": "T1528",
          "name": "Steal Application Access Token",
          "display_name": "T1528 - Steal Application Access Token"
        },
        {
          "id": "T1534",
          "name": "Internal Spearphishing",
          "display_name": "T1534 - Internal Spearphishing"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 46,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "AlienVault",
        "id": "2",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png",
        "is_subscribed": true,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 31
      },
      "indicator_count": 31,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 386980,
      "modified_text": "347 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6341d1aa0a02a3f6251ab540",
      "name": "Sinking Yachts Phishing Domains",
      "description": "Sinking Yachts is a Discord based anti-phishing project founded by @nwunder. This project focuses on collecting and flagging domains that are running phishing scams against Discord or Steam, which are often spread with scam messages from compromised accounts. This collection mirrors the entire database and is updated in real time. Website: https://sinking.yachts API: https://phish.sinking.yachts Discord: https://discord.gg/cT6eQjWW8H (temporarily closed) Need to get in touch? Please email admin@fishfish.gg.",
      "modified": "2026-05-14T18:21:18.798000",
      "created": "2022-10-08T19:38:18.341000",
      "tags": [
        "discord",
        "roblox",
        "steam",
        "phishing"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "gaming"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 75566,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "__akac__",
        "id": "175104",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_175104/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 542,
        "hostname": 646
      },
      "indicator_count": 1188,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 521,
      "modified_text": "19 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 0
    },
    {
      "id": "69aefcc5d258300fb3e319e4",
      "name": "sinking yachts clone __akac__ ....",
      "description": "",
      "modified": "2026-05-14T18:21:18.798000",
      "created": "2026-03-09T17:00:53.305000",
      "tags": [
        "discord",
        "roblox",
        "steam",
        "phishing"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "gaming"
      ],
      "TLP": "white",
      "cloned_from": "6341d1aa0a02a3f6251ab540",
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 542,
        "hostname": 646
      },
      "indicator_count": 1188,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 73,
      "modified_text": "19 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 0
    },
    {
      "id": "69aefcc810c78c89c7f6bb87",
      "name": "sinking yachts clone __akac__ ....",
      "description": "",
      "modified": "2026-05-14T18:21:18.798000",
      "created": "2026-03-09T17:00:56.488000",
      "tags": [
        "discord",
        "roblox",
        "steam",
        "phishing"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "gaming"
      ],
      "TLP": "white",
      "cloned_from": "6341d1aa0a02a3f6251ab540",
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 542,
        "hostname": 647
      },
      "indicator_count": 1189,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 73,
      "modified_text": "19 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 0
    },
    {
      "id": "6785dccb041b628fde283705",
      "name": "phish.directory",
      "description": "phish.directory, a community-driven anti-phishing tool. Helping catch, prevent, and catalog phishing links & attempts.\n\nsee our website at https://phish.directory",
      "modified": "2026-01-25T18:05:17.629000",
      "created": "2025-01-14T03:40:59.456000",
      "tags": [
        "phishing",
        "scams",
        "steam",
        "discord",
        "roblox"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": true,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "jaspermayone",
        "id": "305022",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 41514,
        "hostname": 11318
      },
      "indicator_count": 52832,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 3,
      "modified_text": "128 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "steamcommunitiny.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "steamcommunitiny.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780448220.5798938
}