minasagdic.com Open in urlscan Pro
2606:4700:3032::681c:864  Malicious Activity! Public Scan

Submitted URL: http://u5521270.ct.sendgrid.net/ls/click?upn=6AQzciFSN06nrvyejmefERELyRhg1DIFObknrb2JzbXuCGaZcPIW7sKp9dbVFudj-2BZmjrhJeoE11k-2FA...
Effective URL: http://minasagdic.com/wp-content/themes/lensa/includes/p1/SF-Express/ti85to465zwfe0q09c5ipwsl.php?LAK32J159677767340ab...
Submission: On August 07 via manual from SG

Summary

This website contacted 4 IPs in 2 countries across 5 domains to perform 11 HTTP transactions. The main IP is 2606:4700:3032::681c:864, located in United States and belongs to CLOUDFLARENET, US. The main domain is minasagdic.com.
This is the only time minasagdic.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: SF Express (Transportation)

Domain & IP information

IP Address AS Autonomous System
1 1 167.89.115.54 11377 (SENDGRID)
1 3 2606:4700:303... 13335 (CLOUDFLAR...)
13 20 203.205.137.123 132203 (TENCENT-N...)
1 123.56.12.94 37963 (CNNIC-ALI...)
1 103.60.165.118 137697 (CHINATELE...)
11 4
Apex Domain
Subdomains
Transfer
20 sf-express.com
www.sf-express.com
33 KB
3 minasagdic.com
minasagdic.com
8 KB
1 ebs.org.cn
szcert.ebs.org.cn
10 KB
1 cnmstl.net
webcert.cnmstl.net
3 KB
1 sendgrid.net
u5521270.ct.sendgrid.net
308 B
11 5
Domain Requested by
20 www.sf-express.com 13 redirects minasagdic.com
3 minasagdic.com 1 redirects minasagdic.com
1 szcert.ebs.org.cn minasagdic.com
1 webcert.cnmstl.net minasagdic.com
1 u5521270.ct.sendgrid.net 1 redirects
11 5
Subject Issuer Validity Valid
*.sf-express.com
DigiCert CN RSA CA G1
2020-02-27 -
2022-04-02
2 years crt.sh

This page contains 1 frames:

Primary Page: http://minasagdic.com/wp-content/themes/lensa/includes/p1/SF-Express/ti85to465zwfe0q09c5ipwsl.php?LAK32J159677767340ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd&login=angeline.pua@sc.com
Frame ID: 5CDFDE7FD643AA717911D17EFD932401
Requests: 11 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://u5521270.ct.sendgrid.net/ls/click?upn=6AQzciFSN06nrvyejmefERELyRhg1DIFObknrb2JzbXuCGaZcPIW7sKp9dbVFud... HTTP 302
    http://minasagdic.com/wp-content/themes/lensa/includes/p1/SF-Express/index.php?login=angeline.pua@... HTTP 302
    http://minasagdic.com/wp-content/themes/lensa/includes/p1/SF-Express/ti85to465zwfe0q09c5ipwsl.php?... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Page Statistics

11
Requests

64 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

4
IPs

2
Countries

49 kB
Transfer

86 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://u5521270.ct.sendgrid.net/ls/click?upn=6AQzciFSN06nrvyejmefERELyRhg1DIFObknrb2JzbXuCGaZcPIW7sKp9dbVFudj-2BZmjrhJeoE11k-2FAGlCgjbKky-2BouE-2BJXj8iBWYdim0n-2FysNxy4-2FfhzOWzZ7rqXi2yVyF7rnKH5pzaSbd1VRcxYQv-2Bv55LVaZ9w-2Ffwn5BKvao-3DBgk9_SsElsxXfZRm-2BBEve7cRPUAndovGBujkO533Dz5xefVVyVfRW2diFDiyEvfgcy-2F4RyK2Put1XtdFi3KSjXOcanCwIoFkhxKzaEfd4wDSH8SWw8xSYRHvpqIRPaZMa3C-2FKeGzw6g-2BwHVc3Hl-2Fi1eaFvMndBXN1JmKbvbSBvzY3-2Bpl-2FG3CyYwdqX6qDidwZYPdjt-2B-2FzupzjmTtVmWLzRuU9Og-3D-3D HTTP 302
    http://minasagdic.com/wp-content/themes/lensa/includes/p1/SF-Express/index.php?login=angeline.pua@sc.com HTTP 302
    http://minasagdic.com/wp-content/themes/lensa/includes/p1/SF-Express/ti85to465zwfe0q09c5ipwsl.php?LAK32J159677767340ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd&login=angeline.pua@sc.com Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://www.sf-express.com/resource/images/index/sf.png HTTP 302
  • https://www.sf-express.com/resource/images/index/sf.png
Request Chain 1
  • http://www.sf-express.com/cn/sc/dynamic_function/images/index/header-phoneicon.png HTTP 302
  • https://www.sf-express.com/cn/sc/dynamic_function/images/index/header-phoneicon.png HTTP 302
  • http://www.sf-express.com/cn/sc/404.html HTTP 302
  • https://www.sf-express.com/cn/sc/404.html
Request Chain 3
  • http://www.sf-express.com/.gallery/other/security_site_1.png HTTP 302
  • https://www.sf-express.com/.gallery/other/security_site_1.png
Request Chain 4
  • http://www.sf-express.com/.gallery/other/security_site_2.png HTTP 302
  • https://www.sf-express.com/.gallery/other/security_site_2.png
Request Chain 6
  • http://www.sf-express.com/.gallery/other/security_site_3.png HTTP 302
  • https://www.sf-express.com/.gallery/other/security_site_3.png
Request Chain 8
  • http://www.sf-express.com/cn/sc/dynamic_function/images/index/label-top-r-btn.png HTTP 302
  • https://www.sf-express.com/cn/sc/dynamic_function/images/index/label-top-r-btn.png HTTP 302
  • http://www.sf-express.com/cn/sc/404.html HTTP 302
  • https://www.sf-express.com/cn/sc/404.html
Request Chain 9
  • http://www.sf-express.com/cn/sc/dynamic_function/images/index/bottom-nav-cn.png HTTP 302
  • https://www.sf-express.com/cn/sc/dynamic_function/images/index/bottom-nav-cn.png HTTP 302
  • http://www.sf-express.com/cn/sc/404.html HTTP 302
  • https://www.sf-express.com/cn/sc/404.html

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request ti85to465zwfe0q09c5ipwsl.php
minasagdic.com/wp-content/themes/lensa/includes/p1/SF-Express/
Redirect Chain
  • http://u5521270.ct.sendgrid.net/ls/click?upn=6AQzciFSN06nrvyejmefERELyRhg1DIFObknrb2JzbXuCGaZcPIW7sKp9dbVFudj-2BZmjrhJeoE11k-2FAGlCgjbKky-2BouE-2BJXj8iBWYdim0n-2FysNxy4-2FfhzOWzZ7rqXi2yVyF7rnKH5pza...
  • http://minasagdic.com/wp-content/themes/lensa/includes/p1/SF-Express/index.php?login=angeline.pua@sc.com
  • http://minasagdic.com/wp-content/themes/lensa/includes/p1/SF-Express/ti85to465zwfe0q09c5ipwsl.php?LAK32J159677767340ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c9...
46 KB
7 KB
Document
General
Full URL
http://minasagdic.com/wp-content/themes/lensa/includes/p1/SF-Express/ti85to465zwfe0q09c5ipwsl.php?LAK32J159677767340ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd&login=angeline.pua@sc.com
Protocol
HTTP/1.1
Server
2606:4700:3032::681c:864 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
448a13590a5481f0da61561d125cdb64f83248e90a6d059fbf94b807c80e95ed

Request headers

Host
minasagdic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Cookie
__cfduid=dfa29c518fc1dec9331a2a97c21ed8f6e1596777673
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 07 Aug 2020 05:21:13 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
CF-Cache-Status
DYNAMIC
cf-request-id
0468f6ca990000c2b89b874200000001
Server
cloudflare
CF-RAY
5bee8d8a8a29c2b8-FRA
Content-Encoding
gzip

Redirect headers

Date
Fri, 07 Aug 2020 05:21:13 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
__cfduid=dfa29c518fc1dec9331a2a97c21ed8f6e1596777673; expires=Sun, 06-Sep-20 05:21:13 GMT; path=/; domain=.minasagdic.com; HttpOnly; SameSite=Lax
Location
ti85to465zwfe0q09c5ipwsl.php?LAK32J159677767340ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd&login=angeline.pua@sc.com
CF-Cache-Status
DYNAMIC
cf-request-id
0468f6ca670000c2b89b860200000001
Server
cloudflare
CF-RAY
5bee8d8a3971c2b8-FRA
sf.png
www.sf-express.com/resource/images/index/
Redirect Chain
  • http://www.sf-express.com/resource/images/index/sf.png
  • https://www.sf-express.com/resource/images/index/sf.png
3 KB
3 KB
Image
General
Full URL
https://www.sf-express.com/resource/images/index/sf.png
Requested by
Host: minasagdic.com
URL: http://minasagdic.com/wp-content/themes/lensa/includes/p1/SF-Express/ti85to465zwfe0q09c5ipwsl.php?LAK32J159677767340ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd&login=angeline.pua@sc.com
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.205.137.123 Shenzhen, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
NWS_Oversea_AP /
Resource Hash
8a73edb31547956a8ef9b87d84795705f1efb0f65531c3b3a58d83fbcb6d93c9

Request headers

Referer
http://minasagdic.com/wp-content/themes/lensa/includes/p1/SF-Express/ti85to465zwfe0q09c5ipwsl.php?LAK32J159677767340ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd&login=angeline.pua@sc.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 07 Aug 2020 05:21:17 GMT
X-Cache-Lookup
Hit From Disktank3
Last-Modified
Wed, 29 Jul 2020 10:02:45 GMT
Server
NWS_Oversea_AP
X-NWS-UUID-VERIFY
60ed4bc7538968179b466dd76c87f028
ETag
"5f214945-afc"
Content-Type
image/png
Cache-Control
max-age=600
X-NWS-LOG-UUID
ab802118-8af1-442e-a74a-138a49d0d68a
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2812
Expires
Fri, 07 Aug 2020 05:31:16 GMT

Redirect headers

Location
https://www.sf-express.com/resource/images/index/sf.png
Date
Fri, 07 Aug 2020 05:21:15 GMT
Server
NWS_Oversea_AP
Connection
keep-alive
Content-Length
50
404.html
www.sf-express.com/cn/sc/
Redirect Chain
  • http://www.sf-express.com/cn/sc/dynamic_function/images/index/header-phoneicon.png
  • https://www.sf-express.com/cn/sc/dynamic_function/images/index/header-phoneicon.png
  • http://www.sf-express.com/cn/sc/404.html
  • https://www.sf-express.com/cn/sc/404.html
0
0
Image
General
Full URL
https://www.sf-express.com/cn/sc/404.html
Requested by
Host: minasagdic.com
URL: http://minasagdic.com/wp-content/themes/lensa/includes/p1/SF-Express/ti85to465zwfe0q09c5ipwsl.php?LAK32J159677767340ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd&login=angeline.pua@sc.com
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.205.137.123 Shenzhen, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://minasagdic.com/wp-content/themes/lensa/includes/p1/SF-Express/ti85to465zwfe0q09c5ipwsl.php?LAK32J159677767340ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd&login=angeline.pua@sc.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

Location
https://www.sf-express.com/cn/sc/404.html
Date
Fri, 07 Aug 2020 05:21:16 GMT
Server
NWS_Oversea_AP
Connection
keep-alive
Content-Length
36
officialbrand_small_h_img.jpg
webcert.cnmstl.net/images/cert/code/
3 KB
3 KB
Image
General
Full URL
http://webcert.cnmstl.net/images/cert/code/officialbrand_small_h_img.jpg?sn=c6cc6af3fac440c28901c15a104582fe&t=1476167429157
Requested by
Host: minasagdic.com
URL: http://minasagdic.com/wp-content/themes/lensa/includes/p1/SF-Express/ti85to465zwfe0q09c5ipwsl.php?LAK32J159677767340ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd&login=angeline.pua@sc.com
Protocol
HTTP/1.1
Server
123.56.12.94 Hangzhou, China, ASN37963 (CNNIC-ALIBABA-CN-NET-AP Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software
/
Resource Hash
75fab0d1416ba599a70fae571a4dd33f2f81b99fc84269c99b8710049ffe6caf

Request headers

Referer
http://minasagdic.com/wp-content/themes/lensa/includes/p1/SF-Express/ti85to465zwfe0q09c5ipwsl.php?LAK32J159677767340ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd&login=angeline.pua@sc.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Fri, 07 Aug 2020 05:21:14 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
Connection
keep-alive
Vary
Accept-Encoding
Content-Type
image/png; charset=utf-8
security_site_1.png
www.sf-express.com/.gallery/other/
Redirect Chain
  • http://www.sf-express.com/.gallery/other/security_site_1.png
  • https://www.sf-express.com/.gallery/other/security_site_1.png
3 KB
4 KB
Image
General
Full URL
https://www.sf-express.com/.gallery/other/security_site_1.png
Requested by
Host: minasagdic.com
URL: http://minasagdic.com/wp-content/themes/lensa/includes/p1/SF-Express/ti85to465zwfe0q09c5ipwsl.php?LAK32J159677767340ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd&login=angeline.pua@sc.com
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.205.137.123 Shenzhen, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
NWS_Oversea_AP /
Resource Hash
ec3c1154d95327d79118d2ea0320ead3e3ab4e29431c21c34012a1f896c36dc4

Request headers

Referer
http://minasagdic.com/wp-content/themes/lensa/includes/p1/SF-Express/ti85to465zwfe0q09c5ipwsl.php?LAK32J159677767340ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd&login=angeline.pua@sc.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 07 Aug 2020 05:21:17 GMT
X-Cache-Lookup
Hit From Disktank3
Last-Modified
Mon, 03 Aug 2020 01:14:57 GMT
Server
NWS_Oversea_AP
X-NWS-UUID-VERIFY
d22c922615c262e54ee446af6236d739
ETag
"5f276511-cc6"
Content-Type
image/png
Cache-Control
max-age=600
X-NWS-LOG-UUID
362662b5-b336-4249-8823-a103ccf93644
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3270
Expires
Fri, 07 Aug 2020 05:31:16 GMT

Redirect headers

Location
https://www.sf-express.com/.gallery/other/security_site_1.png
Date
Fri, 07 Aug 2020 05:21:15 GMT
Server
NWS_Oversea_AP
Connection
keep-alive
Content-Length
56
security_site_2.png
www.sf-express.com/.gallery/other/
Redirect Chain
  • http://www.sf-express.com/.gallery/other/security_site_2.png
  • https://www.sf-express.com/.gallery/other/security_site_2.png
3 KB
3 KB
Image
General
Full URL
https://www.sf-express.com/.gallery/other/security_site_2.png
Requested by
Host: minasagdic.com
URL: http://minasagdic.com/wp-content/themes/lensa/includes/p1/SF-Express/ti85to465zwfe0q09c5ipwsl.php?LAK32J159677767340ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd&login=angeline.pua@sc.com
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.205.137.123 Shenzhen, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
NWS_Oversea_AP /
Resource Hash
006ac205426fd7b3e79f3d6d414889d52f87daa2731a8264469984850714c18d

Request headers

Referer
http://minasagdic.com/wp-content/themes/lensa/includes/p1/SF-Express/ti85to465zwfe0q09c5ipwsl.php?LAK32J159677767340ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd&login=angeline.pua@sc.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 07 Aug 2020 05:21:17 GMT
X-Cache-Lookup
Hit From Disktank3
Last-Modified
Mon, 03 Aug 2020 01:14:57 GMT
Server
NWS_Oversea_AP
X-NWS-UUID-VERIFY
7673ec06ee8545bd88be2fc0252b0094
ETag
"5f276511-a93"
Content-Type
image/png
Cache-Control
max-age=600
X-NWS-LOG-UUID
f164a02b-bf97-43b5-b858-7dff97829e63
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2707
Expires
Fri, 07 Aug 2020 05:31:16 GMT

Redirect headers

Location
https://www.sf-express.com/.gallery/other/security_site_2.png
Date
Fri, 07 Aug 2020 05:21:15 GMT
Server
NWS_Oversea_AP
Connection
keep-alive
Content-Length
56
govIcon.gif
szcert.ebs.org.cn/Images/
9 KB
10 KB
Image
General
Full URL
http://szcert.ebs.org.cn/Images/govIcon.gif
Requested by
Host: minasagdic.com
URL: http://minasagdic.com/wp-content/themes/lensa/includes/p1/SF-Express/ti85to465zwfe0q09c5ipwsl.php?LAK32J159677767340ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd&login=angeline.pua@sc.com
Protocol
HTTP/1.1
Server
103.60.165.118 , China, ASN137697 (CHINATELECOM-JIANGSU-YANGZHOU-IDC CHINATELECOM JiangSu YangZhou IDC networkdescr: YangZhouJiangsu Province, P.R.China., CN),
Reverse DNS
Software
waf /
Resource Hash
6879f6200421154baabd4682320d1a1ff600830520ff73697f61c1c8759a6a3f

Request headers

Referer
http://minasagdic.com/wp-content/themes/lensa/includes/p1/SF-Express/ti85to465zwfe0q09c5ipwsl.php?LAK32J159677767340ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd&login=angeline.pua@sc.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 07 Aug 2020 05:19:55 GMT
Last-Modified
Fri, 24 May 2019 09:57:33 GMT
Server
waf
ETag
"4615d91b1712d51:0"
Access-Control-Allow-Methods
GET,POST,PUT,DELETE,OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
X-Cache
HIT from szcert.ebs.org.cn
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
content-type,api_key,Authorization
Content-Length
9481
security_site_3.png
www.sf-express.com/.gallery/other/
Redirect Chain
  • http://www.sf-express.com/.gallery/other/security_site_3.png
  • https://www.sf-express.com/.gallery/other/security_site_3.png
19 KB
19 KB
Image
General
Full URL
https://www.sf-express.com/.gallery/other/security_site_3.png
Requested by
Host: minasagdic.com
URL: http://minasagdic.com/wp-content/themes/lensa/includes/p1/SF-Express/ti85to465zwfe0q09c5ipwsl.php?LAK32J159677767340ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd&login=angeline.pua@sc.com
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.205.137.123 Shenzhen, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
NWS_Oversea_AP /
Resource Hash
a20583c81805fe64f7fa210851ce29754af9d25fd6aa5a3225a9557529602513

Request headers

Referer
http://minasagdic.com/wp-content/themes/lensa/includes/p1/SF-Express/ti85to465zwfe0q09c5ipwsl.php?LAK32J159677767340ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd&login=angeline.pua@sc.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 07 Aug 2020 05:21:17 GMT
X-Cache-Lookup
Hit From Disktank3
Last-Modified
Wed, 29 Jul 2020 10:02:54 GMT
Server
NWS_Oversea_AP
X-NWS-UUID-VERIFY
d696b0d07c3453cdfc47f80c192fd014
ETag
"5f21494e-4b38"
Content-Type
image/png
Cache-Control
max-age=600
X-NWS-LOG-UUID
7b03c289-9ce8-4bde-8229-6beff4d7ac45
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
19256
Expires
Fri, 07 Aug 2020 05:31:16 GMT

Redirect headers

Location
https://www.sf-express.com/.gallery/other/security_site_3.png
Date
Fri, 07 Aug 2020 05:21:15 GMT
Server
NWS_Oversea_AP
Connection
keep-alive
Content-Length
56
email-decode.min.js
minasagdic.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/
1 KB
1 KB
Script
General
Full URL
http://minasagdic.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: minasagdic.com
URL: http://minasagdic.com/wp-content/themes/lensa/includes/p1/SF-Express/ti85to465zwfe0q09c5ipwsl.php?LAK32J159677767340ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd&login=angeline.pua@sc.com
Protocol
HTTP/1.1
Server
2606:4700:3032::681c:864 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
http://minasagdic.com/wp-content/themes/lensa/includes/p1/SF-Express/ti85to465zwfe0q09c5ipwsl.php?LAK32J159677767340ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd&login=angeline.pua@sc.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 07 Aug 2020 05:21:13 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Last-Modified
Wed, 05 Aug 2020 10:00:12 GMT
Server
cloudflare
ETag
W/"5f2a832c-4d7"
X-Frame-Options
SAMEORIGIN
Content-Type
application/javascript
Cache-Control
max-age=172800, public
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
5bee8d8babf6c2b8-FRA
cf-request-id
0468f6cb4c0000c2b89b883200000001
Expires
Sun, 09 Aug 2020 05:21:13 GMT
404.html
www.sf-express.com/cn/sc/
Redirect Chain
  • http://www.sf-express.com/cn/sc/dynamic_function/images/index/label-top-r-btn.png
  • https://www.sf-express.com/cn/sc/dynamic_function/images/index/label-top-r-btn.png
  • http://www.sf-express.com/cn/sc/404.html
  • https://www.sf-express.com/cn/sc/404.html
0
0
Image
General
Full URL
https://www.sf-express.com/cn/sc/404.html
Requested by
Host: minasagdic.com
URL: http://minasagdic.com/wp-content/themes/lensa/includes/p1/SF-Express/ti85to465zwfe0q09c5ipwsl.php?LAK32J159677767340ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd&login=angeline.pua@sc.com
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.205.137.123 Shenzhen, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://minasagdic.com/wp-content/themes/lensa/includes/p1/SF-Express/ti85to465zwfe0q09c5ipwsl.php?LAK32J159677767340ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd&login=angeline.pua@sc.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

Location
https://www.sf-express.com/cn/sc/404.html
Date
Fri, 07 Aug 2020 05:21:16 GMT
Server
NWS_Oversea_AP
Connection
keep-alive
Content-Length
36
404.html
www.sf-express.com/cn/sc/
Redirect Chain
  • http://www.sf-express.com/cn/sc/dynamic_function/images/index/bottom-nav-cn.png
  • https://www.sf-express.com/cn/sc/dynamic_function/images/index/bottom-nav-cn.png
  • http://www.sf-express.com/cn/sc/404.html
  • https://www.sf-express.com/cn/sc/404.html
0
0
Image
General
Full URL
https://www.sf-express.com/cn/sc/404.html
Requested by
Host: minasagdic.com
URL: http://minasagdic.com/wp-content/themes/lensa/includes/p1/SF-Express/ti85to465zwfe0q09c5ipwsl.php?LAK32J159677767340ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd&login=angeline.pua@sc.com
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.205.137.123 Shenzhen, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://minasagdic.com/wp-content/themes/lensa/includes/p1/SF-Express/ti85to465zwfe0q09c5ipwsl.php?LAK32J159677767340ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd40ab75b2d2e6f9932c92bdcf89ee82bd&login=angeline.pua@sc.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

Location
https://www.sf-express.com/cn/sc/404.html
Date
Fri, 07 Aug 2020 05:21:16 GMT
Server
NWS_Oversea_AP
Connection
keep-alive
Content-Length
36

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: SF Express (Transportation)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies