syn.garynissan.com - urlscan.io

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 172.94.37.7, located in Copenhagen, Denmark and belongs to M247, GB. The main domain is syn.garynissan.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on April 28th 2020. Valid for: 3 months.

This is the only time syn.garynissan.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: SF Express (Transportation)

Domain & IP information

	IP Address		AS Autonomous System
2 9	172.94.37.7 172.94.37.7		9009 (M247) (M247)
7	1

9 172.94.37.7 (Copenhagen, Denmark) 2 redirects

ASN9009 (M247, GB)

syn.garynissan.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	garynissan.com 2 redirects syn.garynissan.com	337 KB
7	1

	Domain	Requested by
9	syn.garynissan.com	2 redirects syn.garynissan.com
7	1

This site contains no links.

Subject Issuer	Validity	Valid
syn.garynissan.com Let's Encrypt Authority X3	`2020-04-28` - `2020-07-27`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://syn.garynissan.com/mmkh/Sf-express/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=nobody@mycraftmail.com
Frame ID: 54815910F5F05931958A67C64D8F62E8
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://syn.garynissan.com/mmkh/Sf-express?email=nobody@mycraftmail.com HTTP 301
https://syn.garynissan.com/mmkh/Sf-express/?email=nobody@mycraftmail.com HTTP 302
https://syn.garynissan.com/mmkh/Sf-express/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLig... Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

7
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

337 kB
Transfer

337 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://syn.garynissan.com/mmkh/Sf-express?email=nobody@mycraftmail.com HTTP 301
https://syn.garynissan.com/mmkh/Sf-express/?email=nobody@mycraftmail.com HTTP 302
https://syn.garynissan.com/mmkh/Sf-express/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=nobody@mycraftmail.com Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request login.php Show response
syn.garynissan.com/mmkh/Sf-express/
Redirect Chain

https://syn.garynissan.com/mmkh/Sf-express?email=nobody@mycraftmail.com
https://syn.garynissan.com/mmkh/Sf-express/?email=nobody@mycraftmail.com
https://syn.garynissan.com/mmkh/Sf-express/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=nobody@mycraftmail.com

3 KB
1 KB

79ms
79ms

Document
text/html

172.94.37.7
M247

General

Check archive.org

Show headers Download Go to

Full URL

https://syn.garynissan.com/mmkh/Sf-express/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=nobody@mycraftmail.com

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

172.94.37.7 Copenhagen, Denmark, ASN9009 (M247, GB),

Reverse DNS

Software

nginx /

Resource Hash

c86a596de0e02c50067308537f7234353a844ebc2ec6052ad0bb35014edadb32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: syn.garynissan.com
:scheme: https
:path: /mmkh/Sf-express/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=nobody@mycraftmail.com
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
server: nginx
date: Thu, 30 Apr 2020 12:18:19 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-cache-status: BYPASS
x-server-powered-by: Engintron
content-encoding: gzip

Redirect headers

status: 302
server: nginx
date: Thu, 30 Apr 2020 12:18:19 GMT
content-type: text/html; charset=UTF-8
content-length: 0
location: login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=nobody@mycraftmail.com
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-cache-status: MISS
x-server-powered-by: Engintron

GET
H2 200 f1.png
syn.garynissan.com/mmkh/Sf-express/images/ 14 KB
14 KB 138ms
138ms Image
image/png 172.94.37.7
M247

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://syn.garynissan.com/mmkh/Sf-express/images/f1.png
Requested by: Host: syn.garynissan.com
URL: https://syn.garynissan.com/mmkh/Sf-express/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=nobody@mycraftmail.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 172.94.37.7 Copenhagen, Denmark, ASN9009 (M247, GB),
Reverse DNS
Software: nginx /
Resource Hash: 8f22ca235124cc78614e6f0c01a253f7a92b0816a9a0fe152668834bb5982bcb

Request headers

Referer: https://syn.garynissan.com/mmkh/Sf-express/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=nobody@mycraftmail.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: public
date: Thu, 30 Apr 2020 12:18:19 GMT
last-modified: Fri, 23 Feb 2018 03:16:14 GMT
server: nginx
content-type: image/png
status: 200
cache-control: max-age=5184000
accept-ranges: bytes
content-length: 14566
expires: Mon, 29 Jun 2020 12:18:19 GMT

GET
H2 200 f2.png
syn.garynissan.com/mmkh/Sf-express/images/ 306 KB
306 KB 144ms
144ms Image
image/png 172.94.37.7
M247

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://syn.garynissan.com/mmkh/Sf-express/images/f2.png
Requested by: Host: syn.garynissan.com
URL: https://syn.garynissan.com/mmkh/Sf-express/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=nobody@mycraftmail.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 172.94.37.7 Copenhagen, Denmark, ASN9009 (M247, GB),
Reverse DNS
Software: nginx /
Resource Hash: 97158b317fef1a45dc514594232483463ec855abdab4c17c81458246914c205b

Request headers

Referer: https://syn.garynissan.com/mmkh/Sf-express/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=nobody@mycraftmail.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: public
date: Thu, 30 Apr 2020 12:18:19 GMT
last-modified: Fri, 23 Feb 2018 03:16:40 GMT
server: nginx
content-type: image/png
status: 200
cache-control: max-age=5184000
accept-ranges: bytes
content-length: 312987
expires: Mon, 29 Jun 2020 12:18:19 GMT

GET
H2 200 f3.png
syn.garynissan.com/mmkh/Sf-express/images/ 7 KB
8 KB 202ms
201ms Image
image/png 172.94.37.7
M247

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://syn.garynissan.com/mmkh/Sf-express/images/f3.png
Requested by: Host: syn.garynissan.com
URL: https://syn.garynissan.com/mmkh/Sf-express/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=nobody@mycraftmail.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 172.94.37.7 Copenhagen, Denmark, ASN9009 (M247, GB),
Reverse DNS
Software: nginx /
Resource Hash: fbeacd42af783aef811f4d0b11bc5b5db2d982b0ba671b2ca8169d0e16838a12

Request headers

Referer: https://syn.garynissan.com/mmkh/Sf-express/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=nobody@mycraftmail.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: public
date: Thu, 30 Apr 2020 12:18:19 GMT
last-modified: Fri, 23 Feb 2018 04:31:20 GMT
server: nginx
content-type: image/png
status: 200
cache-control: max-age=5184000
accept-ranges: bytes
content-length: 7573
expires: Mon, 29 Jun 2020 12:18:19 GMT

GET
H2 200 f4.png
syn.garynissan.com/mmkh/Sf-express/images/ 1 KB
1 KB 139ms
138ms Image
image/png 172.94.37.7
M247

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://syn.garynissan.com/mmkh/Sf-express/images/f4.png
Requested by: Host: syn.garynissan.com
URL: https://syn.garynissan.com/mmkh/Sf-express/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=nobody@mycraftmail.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 172.94.37.7 Copenhagen, Denmark, ASN9009 (M247, GB),
Reverse DNS
Software: nginx /
Resource Hash: c21cc86d59d62bdf02aab95433013d1018b657703ea711b354c03c0bd3c06643

Request headers

Referer: https://syn.garynissan.com/mmkh/Sf-express/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=nobody@mycraftmail.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: public
date: Thu, 30 Apr 2020 12:18:19 GMT
last-modified: Fri, 23 Feb 2018 03:17:18 GMT
server: nginx
content-type: image/png
status: 200
cache-control: max-age=5184000
accept-ranges: bytes
content-length: 1266
expires: Mon, 29 Jun 2020 12:18:19 GMT

GET
H2 200 f6.png
syn.garynissan.com/mmkh/Sf-express/images/ 5 KB
6 KB 201ms
201ms Image
image/png 172.94.37.7
M247

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://syn.garynissan.com/mmkh/Sf-express/images/f6.png
Requested by: Host: syn.garynissan.com
URL: https://syn.garynissan.com/mmkh/Sf-express/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=nobody@mycraftmail.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 172.94.37.7 Copenhagen, Denmark, ASN9009 (M247, GB),
Reverse DNS
Software: nginx /
Resource Hash: 9198350033847208477b72740ad44e5f4cab9ac47bbf4120062507af7f95bae8

Request headers

Referer: https://syn.garynissan.com/mmkh/Sf-express/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=nobody@mycraftmail.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: public
date: Thu, 30 Apr 2020 12:18:19 GMT
last-modified: Fri, 23 Feb 2018 03:18:00 GMT
server: nginx
content-type: image/png
status: 200
cache-control: max-age=5184000
accept-ranges: bytes
content-length: 5493
expires: Mon, 29 Jun 2020 12:18:19 GMT

GET
H2 200 fg.png
syn.garynissan.com/mmkh/Sf-express/images/ 514 B
693 B 201ms
200ms Image
image/png 172.94.37.7
M247

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://syn.garynissan.com/mmkh/Sf-express/images/fg.png
Requested by: Host: syn.garynissan.com
URL: https://syn.garynissan.com/mmkh/Sf-express/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=nobody@mycraftmail.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 172.94.37.7 Copenhagen, Denmark, ASN9009 (M247, GB),
Reverse DNS
Software: nginx /
Resource Hash: 9aa1ad4eb1c7382cb1fd8a8c70a0a66b49c0e4993adf2707c3d243dbf0684f93

Request headers

Referer: https://syn.garynissan.com/mmkh/Sf-express/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=nobody@mycraftmail.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: public
date: Thu, 30 Apr 2020 12:18:19 GMT
last-modified: Fri, 23 Feb 2018 03:17:40 GMT
server: nginx
content-type: image/png
status: 200
cache-control: max-age=5184000
accept-ranges: bytes
content-length: 514
expires: Mon, 29 Jun 2020 12:18:19 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: SF Express (Transportation)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

syn.garynissan.com
172.94.37.7
8f22ca235124cc78614e6f0c01a253f7a92b0816a9a0fe152668834bb5982bcb
9198350033847208477b72740ad44e5f4cab9ac47bbf4120062507af7f95bae8
97158b317fef1a45dc514594232483463ec855abdab4c17c81458246914c205b
9aa1ad4eb1c7382cb1fd8a8c70a0a66b49c0e4993adf2707c3d243dbf0684f93
c21cc86d59d62bdf02aab95433013d1018b657703ea711b354c03c0bd3c06643
c86a596de0e02c50067308537f7234353a844ebc2ec6052ad0bb35014edadb32
fbeacd42af783aef811f4d0b11bc5b5db2d982b0ba671b2ca8169d0e16838a12

syn.garynissan.com Open in urlscan Pro 172.94.37.7 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

7 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

337 kBTransfer

337 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

syn.garynissan.com Open in urlscan Pro
172.94.37.7 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

337 kB
Transfer

337 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!