roofsupplyco.com Open in urlscan Pro
192.124.249.118  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request index.php Show response roofsupplyco.com/IL/post.il/index/	9 KB 3 KB	249ms 134ms	Document text/html	192.124.249.118 SUCURI-SEC
General Check archive.org Show headers Download Go to Full URL https://roofsupplyco.com/IL/post.il/index/index.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.118 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10118.sucuri.net Software nginx / Resource Hash 1a0612d479f3b7caa334079b64ffb13011822adec6bfbadf0b57b2e6dbb0f334 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36 accept-language en-US,en;q=0.9 Response headers content-encoding br content-length 2745 content-security-policy upgrade-insecure-requests; content-type text/html; charset=UTF-8 date Mon, 05 Dec 2022 15:39:03 GMT server nginx vary Accept-Encoding x-content-type-options nosniff x-frame-options SAMEORIGIN x-sucuri-cache EXPIRED x-sucuri-id 20018 x-xss-protection 1; mode=block
GET H2	200	screen.css roofsupplyco.com/IL/post.il/index/	3 KB 1 KB	68ms 67ms	Stylesheet text/css	192.124.249.118 SUCURI-SEC
General Check archive.org Show headers Download Go to Full URL https://roofsupplyco.com/IL/post.il/index/screen.css Requested by Host: roofsupplyco.com URL: https://roofsupplyco.com/IL/post.il/index/index.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.118 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10118.sucuri.net Software nginx / Resource Hash 4240658116347f70eea6163be279c9c3680dd81cb5f06275bd6a733dab1a91fc Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language en-US,en;q=0.9 Referer https://roofsupplyco.com/IL/post.il/index/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36 Response headers date Mon, 05 Dec 2022 15:39:03 GMT content-security-policy upgrade-insecure-requests; x-content-type-options nosniff content-encoding br x-sucuri-cache MISS content-length 897 x-xss-protection 1; mode=block last-modified Wed, 23 Feb 2022 02:48:50 GMT server nginx etag "24223a8-c14-5d8a6815bc880-br" x-frame-options SAMEORIGIN vary Accept-Encoding content-type text/css cache-control max-age=315360000 x-sucuri-id 20018 accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	gh-buttons.css roofsupplyco.com/IL/post.il/index/	13 KB 2 KB	130ms 130ms	Stylesheet text/css	192.124.249.118 SUCURI-SEC
General Check archive.org Show headers Download Go to Full URL https://roofsupplyco.com/IL/post.il/index/gh-buttons.css Requested by Host: roofsupplyco.com URL: https://roofsupplyco.com/IL/post.il/index/index.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.118 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10118.sucuri.net Software nginx / Resource Hash 686251c35af3f83c0532d534a4df34651f06a875fe2b70a7f450c702106f2555 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language en-US,en;q=0.9 Referer https://roofsupplyco.com/IL/post.il/index/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36 Response headers date Mon, 05 Dec 2022 15:39:03 GMT content-security-policy upgrade-insecure-requests; x-content-type-options nosniff content-encoding br x-sucuri-cache MISS content-length 1987 x-xss-protection 1; mode=block last-modified Wed, 23 Feb 2022 02:48:58 GMT server nginx etag "24223af-3290-5d8a681d5da80-br" x-frame-options SAMEORIGIN vary Accept-Encoding content-type text/css cache-control max-age=315360000 x-sucuri-id 20018 accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	commons.js Show response roofsupplyco.com/IL/post.il/index/	1 KB 894 B	118ms 117ms	Script application/javascript	192.124.249.118 SUCURI-SEC
General Check archive.org Show headers Download Go to Full URL https://roofsupplyco.com/IL/post.il/index/commons.js Requested by Host: roofsupplyco.com URL: https://roofsupplyco.com/IL/post.il/index/index.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.118 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10118.sucuri.net Software nginx / Resource Hash 2da2729846948ccfd97ed924936cdc406a1037b4af9bf77d98027c1576d8f8cd Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language en-US,en;q=0.9 Referer https://roofsupplyco.com/IL/post.il/index/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36 Response headers date Mon, 05 Dec 2022 15:39:03 GMT content-security-policy upgrade-insecure-requests; x-content-type-options nosniff content-encoding br x-sucuri-cache MISS content-length 504 x-xss-protection 1; mode=block last-modified Wed, 23 Feb 2022 02:49:12 GMT server nginx etag "24223aa-4b2-5d8a682ab7a00-br" x-frame-options SAMEORIGIN vary Accept-Encoding content-type application/javascript cache-control max-age=315360000 x-sucuri-id 20018 accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	banar.jpg roofsupplyco.com/IL/post.il/index/	25 KB 25 KB	34ms 34ms	Image image/jpeg	192.124.249.118 SUCURI-SEC
General Check archive.org Show headers Download Go to Show image Full URL https://roofsupplyco.com/IL/post.il/index/banar.jpg Requested by Host: roofsupplyco.com URL: https://roofsupplyco.com/IL/post.il/index/index.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.118 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10118.sucuri.net Software nginx / Resource Hash a44c24282d9380566e33a10948c78dab06ac24a1ad6c6596f02f337f013ec220 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language en-US,en;q=0.9 Referer https://roofsupplyco.com/IL/post.il/index/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36 Response headers date Mon, 05 Dec 2022 15:39:03 GMT content-security-policy upgrade-insecure-requests; x-content-type-options nosniff last-modified Mon, 28 Mar 2022 20:20:04 GMT server nginx etag "24223b2-6391-5db4d09a00500" x-frame-options SAMEORIGIN content-type image/jpeg x-sucuri-cache HIT cache-control max-age=315360000 x-sucuri-id 20018 accept-ranges bytes content-length 25489 x-xss-protection 1; mode=block expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	register-ad.png israelpost.co.il/media/1096/	74 KB 74 KB	719ms 228ms	Image image/png	66.22.35.41 RADWARE
General Check archive.org Show headers Download Go to Show image Full URL https://israelpost.co.il/media/1096/register-ad.png Requested by Host: roofsupplyco.com URL: https://roofsupplyco.com/IL/post.il/index/index.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 66.22.35.41 , United States, ASN48851 (RADWARE, IL), Reverse DNS Software / Resource Hash bef05b5087b95f81b1517c93eb7f47d1755d5d95adf41eff841cad5f8dd388ac Request headers accept-language en-US,en;q=0.9 Referer https://roofsupplyco.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36 Response headers date Mon, 05 Dec 2022 15:39:04 GMT last-modified Mon, 01 Feb 2021 08:51:50 GMT etag "d2c2307b77f8d61:0" content-type image/png access-control-expose-headers Request-Context cache-control max-age=86400 accept-ranges bytes content-length 75537 request-context appId=cid-v1:61665634-75fc-415e-8cc8-63525a50cf85
GET H2	404	gh-icons.png roofsupplyco.com/IL/post.il/index/	315 B 315 B	50ms 49ms	Image text/html	192.124.249.118 SUCURI-SEC
General Check archive.org Show headers Download Go to Show image Full URL https://roofsupplyco.com/IL/post.il/index/gh-icons.png Requested by Host: roofsupplyco.com URL: https://roofsupplyco.com/IL/post.il/index/gh-buttons.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.118 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10118.sucuri.net Software nginx / Resource Hash d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language en-US,en;q=0.9 Referer https://roofsupplyco.com/IL/post.il/index/gh-buttons.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36 Response headers date Mon, 05 Dec 2022 15:39:03 GMT content-security-policy upgrade-insecure-requests; x-content-type-options nosniff server nginx x-frame-options SAMEORIGIN content-type text/html; charset=iso-8859-1 x-sucuri-cache MISS x-sucuri-id 20018 content-length 315 x-xss-protection 1; mode=block

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| changeLanguage function| submitEnter function| dotToComma function| updateViewportOrientation function| onBodyLoad function| validate object| cardNumberField object| cvvField

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://roofsupplyco.com/IL/post.il/index/gh-icons.png Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

israelpost.co.il
roofsupplyco.com
192.124.249.118
66.22.35.41
1a0612d479f3b7caa334079b64ffb13011822adec6bfbadf0b57b2e6dbb0f334
2da2729846948ccfd97ed924936cdc406a1037b4af9bf77d98027c1576d8f8cd
4240658116347f70eea6163be279c9c3680dd81cb5f06275bd6a733dab1a91fc
686251c35af3f83c0532d534a4df34651f06a875fe2b70a7f450c702106f2555
a44c24282d9380566e33a10948c78dab06ac24a1ad6c6596f02f337f013ec220
bef05b5087b95f81b1517c93eb7f47d1755d5d95adf41eff841cad5f8dd388ac
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3