visitors-wa-low-parts.trycloudflare.com

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 104.16.231.132, located in and belongs to CLOUDFLARENET, US. The main domain is visitors-wa-low-parts.trycloudflare.com.
TLS certificate: Issued by E1 on March 28th 2024. Valid for: 3 months.

This is the only time visitors-wa-low-parts.trycloudflare.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Steam (Gaming)

Domain & IP information

	IP Address		AS Autonomous System
1 5	104.16.231.132 104.16.231.132		13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2

5 104.16.231.132 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

visitors-wa-low-parts.trycloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	trycloudflare.com 1 redirects visitors-wa-low-parts.trycloudflare.com	205 KB
4	1

	Domain	Requested by
5	visitors-wa-low-parts.trycloudflare.com	1 redirects visitors-wa-low-parts.trycloudflare.com
4	1

This site contains links to these domains. Also see Links.

Domain
store.steampowered.com
steamcommunity.com
help.steampowered.com
www.valvesoftware.com

Subject Issuer	Validity	Valid
trycloudflare.com E1	`2024-03-28` - `2024-06-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://visitors-wa-low-parts.trycloudflare.com/login.html
Frame ID: BEDBECB064A1A53EF2F36F18D011933C
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign In

Page URL History Show full URLs

http://visitors-wa-low-parts.trycloudflare.com/ HTTP 307
https://visitors-wa-low-parts.trycloudflare.com/ HTTP 302
https://visitors-wa-low-parts.trycloudflare.com/login.html Page URL

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

205 kB
Transfer

257 kB
Size

0
Cookies

11 Outgoing links

These are links going to different origins than the main page.

URL: https://store.steampowered.com/login/?redir=login%2F%3Fredir%3D%26redir_ssl%3D1%26snr%3D1_4_661__global-header&redir_ssl=1&snr=1_60_4__global-header
Title: Login

Search URL Search Domain Scan URL

URL: https://store.steampowered.com/?snr=1_60_4__global-responsive-menu
Title: Store

Search URL Search Domain Scan URL

URL: https://steamcommunity.com/
Title: Community

Search URL Search Domain Scan URL

URL: https://help.steampowered.com/en
Title: Support

Search URL Search Domain Scan URL

URL: https://store.steampowered.com/privacy_agreement/?snr=1_60_4__global-responsive-menu
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: http://www.valvesoftware.com/legal.htm
Title: Legal

Search URL Search Domain Scan URL

URL: https://store.steampowered.com/subscriber_agreement/?snr=1_60_4__global-responsive-menu
Title: Steam Subscriber Agreement

Search URL Search Domain Scan URL

URL: https://store.steampowered.com/steam_refunds/?snr=1_60_4__global-responsive-menu
Title: Refunds

Search URL Search Domain Scan URL

URL: https://store.steampowered.com/mobile
Title: Learn more

Search URL Search Domain Scan URL

URL: https://store.steampowered.com/about
Title: Learn More

Search URL Search Domain Scan URL

URL: https://store.steampowered.com/join/?&snr=1_60_4__62
Title: Join Steam

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://visitors-wa-low-parts.trycloudflare.com/ HTTP 307
https://visitors-wa-low-parts.trycloudflare.com/ HTTP 302
https://visitors-wa-low-parts.trycloudflare.com/login.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request login.html Show response visitors-wa-low-parts.trycloudflare.com/ Redirect Chain http://visitors-wa-low-parts.trycloudflare.com/ https://visitors-wa-low-parts.trycloudflare.com/ https://visitors-wa-low-parts.trycloudflare.com/login.html	49 KB 23 KB	130ms 130ms	Document text/html	104.16.231.132 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://visitors-wa-low-parts.trycloudflare.com/login.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.231.132 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `f5fcedd55a5874e0f1bf6c29bc720a3ad6f331db90ddcd58d52289647fc2bc97` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers cf-cache-status DYNAMIC cf-ray 876f8583cf839bfa-FRA content-encoding gzip content-type text/html; charset=UTF-8 date Fri, 19 Apr 2024 20:07:33 GMT host visitors-wa-low-parts.trycloudflare.com server cloudflare vary Accept-Encoding Redirect headers cf-cache-status DYNAMIC cf-ray 876f85830e609bfa-FRA content-type text/html; charset=UTF-8 date Fri, 19 Apr 2024 20:07:33 GMT host visitors-wa-low-parts.trycloudflare.com location login.html server cloudflare vary Accept-Encoding x-powered-by PHP/8.2.12
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `8b97ba0dac22fe6704c1f6d95fe79613f33017804f256abb9006df0442491787` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `fc9e6260a2706ae146282d77e67bc1b74688435f8912ab4c1932641eec28bffa` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	11 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6cb869df089146c12efb5e9c968e911c314842624ba6f052a11346ac734cadc8` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET H2	200	join.png visitors-wa-low-parts.trycloudflare.com/	33 KB 33 KB	191ms 191ms	Image image/png	104.16.231.132 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://visitors-wa-low-parts.trycloudflare.com/join.png Requested by Host: visitors-wa-low-parts.trycloudflare.com URL: https://visitors-wa-low-parts.trycloudflare.com/login.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.231.132 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `a59657d4f7db10fefd0c0812bc93e00fa5bb4469b7ab55cebd41a0a9961f8e44` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://visitors-wa-low-parts.trycloudflare.com/login.html Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Fri, 19 Apr 2024 20:07:34 GMT cf-cache-status DYNAMIC server cloudflare host visitors-wa-low-parts.trycloudflare.com vary Accept-Encoding content-type image/png cf-ray 876f8584b8de9bfa-FRA content-length 33338
GET H2	200	1.jpg visitors-wa-low-parts.trycloudflare.com/	122 KB 122 KB	112ms 112ms	Image image/jpeg	104.16.231.132 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://visitors-wa-low-parts.trycloudflare.com/1.jpg Requested by Host: visitors-wa-low-parts.trycloudflare.com URL: https://visitors-wa-low-parts.trycloudflare.com/login.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.231.132 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `9a75f8cc40bbe9c9499e7b2d3bab98a447685a361489357a111479517005c954` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://visitors-wa-low-parts.trycloudflare.com/login.html Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Fri, 19 Apr 2024 20:07:33 GMT cf-cache-status DYNAMIC server cloudflare host visitors-wa-low-parts.trycloudflare.com vary Accept-Encoding content-type image/jpeg cf-ray 876f8584b8e19bfa-FRA content-length 124529
GET H2	200	favicon.ico visitors-wa-low-parts.trycloudflare.com/	38 KB 28 KB	81ms 81ms	Other image/vnd.microsoft.icon	104.16.231.132 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://visitors-wa-low-parts.trycloudflare.com/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.231.132 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://visitors-wa-low-parts.trycloudflare.com/login.html Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Fri, 19 Apr 2024 20:07:34 GMT content-encoding gzip cf-cache-status DYNAMIC server cloudflare host visitors-wa-low-parts.trycloudflare.com vary Accept-Encoding content-type image/vnd.microsoft.icon cf-ray 876f85866b5f9bfa-FRA

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Steam (Gaming)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://visitors-wa-low-parts.trycloudflare.com/login.html Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

visitors-wa-low-parts.trycloudflare.com
104.16.231.132
6cb869df089146c12efb5e9c968e911c314842624ba6f052a11346ac734cadc8
8b97ba0dac22fe6704c1f6d95fe79613f33017804f256abb9006df0442491787
9a75f8cc40bbe9c9499e7b2d3bab98a447685a361489357a111479517005c954
9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad
a59657d4f7db10fefd0c0812bc93e00fa5bb4469b7ab55cebd41a0a9961f8e44
f5fcedd55a5874e0f1bf6c29bc720a3ad6f331db90ddcd58d52289647fc2bc97
fc9e6260a2706ae146282d77e67bc1b74688435f8912ab4c1932641eec28bffa

visitors-wa-low-parts.trycloudflare.com Open in urlscan Pro 104.16.231.132 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

4 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

205 kBTransfer

257 kBSize

0 Cookies

11 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

visitors-wa-low-parts.trycloudflare.com Open in urlscan Pro
104.16.231.132 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

205 kB
Transfer

257 kB
Size

0
Cookies

4 HTTP transactions
3 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!