conjunction-cooper-unknown-friends.trycloudflare.com

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 2606:4700::6810:e784, located in United States and belongs to CLOUDFLARENET, US. The main domain is conjunction-cooper-unknown-friends.trycloudflare.com.
TLS certificate: Issued by WE1 on October 27th 2024. Valid for: 3 months.

This is the only time conjunction-cooper-unknown-friends.trycloudflare.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Steam (Gaming)

Domain & IP information

	IP Address		AS Autonomous System
1 5	2606:4700::68... 2606:4700::6810:e784		13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2

5 2606:4700::6810:e784 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

conjunction-cooper-unknown-friends.trycloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	trycloudflare.com 1 redirects conjunction-cooper-unknown-friends.trycloudflare.com	205 KB
4	1

	Domain	Requested by
5	conjunction-cooper-unknown-friends.trycloudflare.com	1 redirects conjunction-cooper-unknown-friends.trycloudflare.com
4	1

This site contains links to these domains. Also see Links.

Domain
store.steampowered.com
steamcommunity.com
help.steampowered.com
www.valvesoftware.com

Subject Issuer	Validity	Valid
trycloudflare.com WE1	`2024-10-27` - `2025-01-25`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://conjunction-cooper-unknown-friends.trycloudflare.com/login.html
Frame ID: 626C98D2F820518D21397178326D6777
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign In

Page URL History Show full URLs

https://conjunction-cooper-unknown-friends.trycloudflare.com/ HTTP 302
https://conjunction-cooper-unknown-friends.trycloudflare.com/login.html Page URL

Page Statistics

4
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

205 kB
Transfer

257 kB
Size

0
Cookies

11 Outgoing links

These are links going to different origins than the main page.

URL: https://store.steampowered.com/login/?redir=login%2F%3Fredir%3D%26redir_ssl%3D1%26snr%3D1_4_661__global-header&redir_ssl=1&snr=1_60_4__global-header
Title: Login

Search URL Search Domain Scan URL

URL: https://store.steampowered.com/?snr=1_60_4__global-responsive-menu
Title: Store

Search URL Search Domain Scan URL

URL: https://steamcommunity.com/
Title: Community

Search URL Search Domain Scan URL

URL: https://help.steampowered.com/en
Title: Support

Search URL Search Domain Scan URL

URL: https://store.steampowered.com/privacy_agreement/?snr=1_60_4__global-responsive-menu
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: http://www.valvesoftware.com/legal.htm
Title: Legal

Search URL Search Domain Scan URL

URL: https://store.steampowered.com/subscriber_agreement/?snr=1_60_4__global-responsive-menu
Title: Steam Subscriber Agreement

Search URL Search Domain Scan URL

URL: https://store.steampowered.com/steam_refunds/?snr=1_60_4__global-responsive-menu
Title: Refunds

Search URL Search Domain Scan URL

URL: https://store.steampowered.com/mobile
Title: Learn more

Search URL Search Domain Scan URL

URL: https://store.steampowered.com/about
Title: Learn More

Search URL Search Domain Scan URL

URL: https://store.steampowered.com/join/?&snr=1_60_4__62
Title: Join Steam

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://conjunction-cooper-unknown-friends.trycloudflare.com/ HTTP 302
https://conjunction-cooper-unknown-friends.trycloudflare.com/login.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request login.html Show response conjunction-cooper-unknown-friends.trycloudflare.com/ Redirect Chain https://conjunction-cooper-unknown-friends.trycloudflare.com/ https://conjunction-cooper-unknown-friends.trycloudflare.com/login.html	49 KB 23 KB	360ms 360ms	Document text/html	2606:4700::6810:e784 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://conjunction-cooper-unknown-friends.trycloudflare.com/login.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:e784 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `f5fcedd55a5874e0f1bf6c29bc720a3ad6f331db90ddcd58d52289647fc2bc97` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers cf-cache-status DYNAMIC cf-ray 8f17f5309eb9d09e-CDG content-encoding gzip content-type text/html; charset=UTF-8 date Fri, 13 Dec 2024 18:18:37 GMT host conjunction-cooper-unknown-friends.trycloudflare.com server cloudflare vary Accept-Encoding Redirect headers cf-cache-status DYNAMIC cf-ray 8f17f52c6a17d09e-CDG content-type text/html; charset=UTF-8 date Fri, 13 Dec 2024 18:18:37 GMT host conjunction-cooper-unknown-friends.trycloudflare.com location login.html server cloudflare vary Accept-Encoding x-powered-by PHP/8.2.21
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `8b97ba0dac22fe6704c1f6d95fe79613f33017804f256abb9006df0442491787` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `fc9e6260a2706ae146282d77e67bc1b74688435f8912ab4c1932641eec28bffa` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer Response headers Content-Type image/png
GET DATA	200 OK	truncated /	11 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6cb869df089146c12efb5e9c968e911c314842624ba6f052a11346ac734cadc8` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer Response headers Content-Type image/png
GET H2	200	join.png conjunction-cooper-unknown-friends.trycloudflare.com/	33 KB 33 KB	282ms 282ms	Image image/png	2606:4700::6810:e784 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://conjunction-cooper-unknown-friends.trycloudflare.com/join.png Requested by Host: conjunction-cooper-unknown-friends.trycloudflare.com URL: https://conjunction-cooper-unknown-friends.trycloudflare.com/login.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:e784 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `a59657d4f7db10fefd0c0812bc93e00fa5bb4469b7ab55cebd41a0a9961f8e44` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://conjunction-cooper-unknown-friends.trycloudflare.com/login.html Response headers cf-cache-status DYNAMIC cf-ray 8f17f532fda1d09e-CDG content-length 33338 date Fri, 13 Dec 2024 18:18:38 GMT content-type image/png host conjunction-cooper-unknown-friends.trycloudflare.com vary Accept-Encoding server cloudflare
GET H2	200	1.jpg conjunction-cooper-unknown-friends.trycloudflare.com/	122 KB 122 KB	256ms 256ms	Image image/jpeg	2606:4700::6810:e784 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://conjunction-cooper-unknown-friends.trycloudflare.com/1.jpg Requested by Host: conjunction-cooper-unknown-friends.trycloudflare.com URL: https://conjunction-cooper-unknown-friends.trycloudflare.com/login.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:e784 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `9a75f8cc40bbe9c9499e7b2d3bab98a447685a361489357a111479517005c954` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://conjunction-cooper-unknown-friends.trycloudflare.com/login.html Response headers cf-cache-status DYNAMIC cf-ray 8f17f532fda5d09e-CDG content-length 124529 date Fri, 13 Dec 2024 18:18:38 GMT content-type image/jpeg host conjunction-cooper-unknown-friends.trycloudflare.com vary Accept-Encoding server cloudflare
GET H2	200	favicon.ico conjunction-cooper-unknown-friends.trycloudflare.com/	38 KB 27 KB	225ms 225ms	Other image/vnd.microsoft.icon	2606:4700::6810:e784 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://conjunction-cooper-unknown-friends.trycloudflare.com/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:e784 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://conjunction-cooper-unknown-friends.trycloudflare.com/login.html Response headers content-encoding gzip cf-cache-status DYNAMIC cf-ray 8f17f534cb03d09e-CDG date Fri, 13 Dec 2024 18:18:38 GMT content-type image/vnd.microsoft.icon host conjunction-cooper-unknown-friends.trycloudflare.com vary Accept-Encoding server cloudflare

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Steam (Gaming)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://conjunction-cooper-unknown-friends.trycloudflare.com/login.html Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

conjunction-cooper-unknown-friends.trycloudflare.com
2606:4700::6810:e784
6cb869df089146c12efb5e9c968e911c314842624ba6f052a11346ac734cadc8
8b97ba0dac22fe6704c1f6d95fe79613f33017804f256abb9006df0442491787
9a75f8cc40bbe9c9499e7b2d3bab98a447685a361489357a111479517005c954
9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad
a59657d4f7db10fefd0c0812bc93e00fa5bb4469b7ab55cebd41a0a9961f8e44
f5fcedd55a5874e0f1bf6c29bc720a3ad6f331db90ddcd58d52289647fc2bc97
fc9e6260a2706ae146282d77e67bc1b74688435f8912ab4c1932641eec28bffa

conjunction-cooper-unknown-friends.trycloudflare.com Open in urlscan Pro 2606:4700::6810:e784 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

4 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

205 kBTransfer

257 kBSize

0 Cookies

11 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

conjunction-cooper-unknown-friends.trycloudflare.com Open in urlscan Pro
2606:4700::6810:e784 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

205 kB
Transfer

257 kB
Size

0
Cookies

4 HTTP transactions
3 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!