roost-claims.com Open in urlscan Pro
172.67.217.43 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://roostcoins.vip/?shiny
Effective URL:
https://roost-claims.com/main
Submission Tags: shiny c290acadafe6362a fc6b18fd85158e2b bfst honeypoter@gmail.com Search All
Submission: On April 01 via api (April 1st 2024, 11:44:02 pm UTC) from JP — Scanned from JP

Summary HTTP 2 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 2 HTTP transactions. The main IP is 172.67.217.43, located in United States and belongs to CLOUDFLARENET, US. The main domain is roost-claims.com.
TLS certificate: Issued by E1 on March 30th 2024. Valid for: 3 months.

This is the only time roost-claims.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3036::6815:2c50	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.67.217.43 172.67.217.43	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2001:df2:e500... 2001:df2:e500:ed1a::2:b	14907 (WIKIMEDIA) (WIKIMEDIA)
2	2

1 2606:4700:3036::6815:2c50 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

roostcoins.vip	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.217.43 (United States)

ASN13335 (CLOUDFLARENET, US)

roost-claims.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:df2:e500:ed1a::2:b (United States)

ASN14907 (WIKIMEDIA, US)

upload.wikimedia.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	wikimedia.org upload.wikimedia.org — Cisco Umbrella Rank: 2958	8 KB
1	roost-claims.com roost-claims.com	1 KB
1	roostcoins.vip 1 redirects roostcoins.vip	501 B
2	3

	Domain	Requested by
1	upload.wikimedia.org
1	roost-claims.com
1	roostcoins.vip	1 redirects
2	3

This site contains no links.

Subject Issuer	Validity	Valid
roost-claims.com E1	`2024-03-30` - `2024-06-28`	3 months	crt.sh
*.wikipedia.org DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-10-18` - `2024-10-16`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://roost-claims.com/main
Frame ID: F9A502A03D907A3A6D51BC7F598D0D26
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Access Restricted - Roost

Page URL History Show full URLs

http://roostcoins.vip/?shiny HTTP 307
https://roostcoins.vip/?shiny HTTP 302
https://roost-claims.com/main Page URL

Page Statistics

2
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

9 kB
Transfer

9 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://roostcoins.vip/?shiny HTTP 307
https://roostcoins.vip/?shiny HTTP 302
https://roost-claims.com/main Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

Primary Request main Show response
roost-claims.com/
Redirect Chain

http://roostcoins.vip/?shiny
https://roostcoins.vip/?shiny
https://roost-claims.com/main

2 KB
1 KB

733ms
216ms

Document
text/html

172.67.217.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://roost-claims.com/main
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.217.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c7d1930d418292435517080e99b39899670fccb83847f6d6f109eb566c32ab30

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: jp-JP,jp;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 86dc71c43fdde031-NRT
content-encoding: br
content-type: text/html
date: Mon, 01 Apr 2024 23:43:58 GMT
last-modified: Fri, 29 Mar 2024 22:35:58 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3gz3PuW0lVfTWEYZSrvYg8LUWRc9R7qnVQfzziHmufJn7TZqD8cbbojJ7vxeLBcBJQsvmDw7%2BieoyusVhVz6idYG6Hnj%2BbC3D2OKbiCpxSY5FtCs604XlJTxVjRHbM%2B%2Fh26q"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 86dc71bd5e240af0-NRT
content-security-policy: referrer no-referrer
content-type: text/html; charset=UTF-8
date: Mon, 01 Apr 2024 23:43:57 GMT
location: https://roost-claims.com/main
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: no-referrer
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Kd3nipiSj2FHsytishRYGsXPYIrHLJIcY%2FUmTmvvpHBoGnVWt7Xvi80IXgR81zw%2F9fQRi%2B4c0Kab8BJiqkiGvF21ZLhqE5ZM0PmViFGbeCOhhyojB8iYTMVUGJs1EoYcikHvBqM31c0%2Bs17Q8w%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 Sample_User_Icon.png
upload.wikimedia.org/wikipedia/commons/9/99/ 7 KB
8 KB 234ms
78ms Other
image/png 2001:df2:e500:ed1a::2:b
WIKIMEDIA

General

Check archive.org

Show headers Download Go to

Full URL

https://upload.wikimedia.org/wikipedia/commons/9/99/Sample_User_Icon.png

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2001:df2:e500:ed1a::2:b , United States, ASN14907 (WIKIMEDIA, US),

Reverse DNS

Software

ATS/9.1.4 /

Resource Hash

5158855d8225154875e4339ffb4c1018eb688e3636edb3ca814bab18ded39165

Security Headers

Name	Value
Strict-Transport-Security	max-age=106384710; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://roost-claims.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 01 Apr 2024 06:58:22 GMT
strict-transport-security: max-age=106384710; includeSubDomains; preload
x-content-type-options: nosniff
nel: { "report_to": "wm_nel", "max_age": 604800, "failure_fraction": 0.05, "success_fraction": 0.0}
age: 60336
x-cache-status: hit-front
x-cache: cp5025 hit, cp5025 hit/148
server-timing: cache;desc="hit-front", host;desc="cp5025"
content-length: 7180
x-client-ip: 2a00:1633:128:4::6
x-object-meta-sha1base36: 3m5sb3dgmosv84krumdlbqwktcgccfr
last-modified: Wed, 23 Sep 2020 14:59:18 GMT
server: ATS/9.1.4
etag: e9e4b7922d30b56a6abe7a18d2f8af48
report-to: { "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] }
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache
accept-ranges: bytes
timing-allow-origin: *

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onpagereveal

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

roost-claims.com
roostcoins.vip
upload.wikimedia.org
172.67.217.43
2001:df2:e500:ed1a::2:b
2606:4700:3036::6815:2c50
5158855d8225154875e4339ffb4c1018eb688e3636edb3ca814bab18ded39165
c7d1930d418292435517080e99b39899670fccb83847f6d6f109eb566c32ab30

roost-claims.com Open in urlscan Pro 172.67.217.43 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

2 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

2 IPs

1 Countries

9 kBTransfer

9 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

0 Cookies

Indicators

roost-claims.com Open in urlscan Pro
172.67.217.43 Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

9 kB
Transfer

9 kB
Size

0
Cookies

2 HTTP transactions
0 data transactions