www.internetservicetech.com Open in urlscan Pro
54.72.163.41 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.internetservicetech.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/j1CXRRh7-
Submission: On December 09 via automatic, source openphish (December 9th 2021, 1:06:37 pm UTC) — Scanned from DE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 54.72.163.41, located in Dublin, Ireland and belongs to AMAZON-02, US. The main domain is www.internetservicetech.com.
TLS certificate: Issued by Amazon on April 29th 2021. Valid for: a year.

This is the only time www.internetservicetech.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Fedex (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1	54.72.163.41 54.72.163.41	16509 (AMAZON-02) (AMAZON-02)
8	13.32.121.70 13.32.121.70	16509 (AMAZON-02) (AMAZON-02)
9	2

1 54.72.163.41 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-72-163-41.eu-west-1.compute.amazonaws.com

www.internetservicetech.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 13.32.121.70 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-121-70.fra60.r.cloudfront.net

cloud.phishinsight.trendmicro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	trendmicro.com cloud.phishinsight.trendmicro.com	113 KB
1	internetservicetech.com www.internetservicetech.com	4 KB
9	2

	Domain	Requested by
8	cloud.phishinsight.trendmicro.com	www.internetservicetech.com cloud.phishinsight.trendmicro.com
1	www.internetservicetech.com
9	2

This site contains no links.

Subject Issuer	Validity	Valid
*.onlineservicegroup.net Amazon	`2021-04-29` - `2022-05-28`	a year	crt.sh
*.phishinsight.trendmicro.com Entrust Certification Authority - L1K	`2020-07-07` - `2022-07-06`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://www.internetservicetech.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/j1CXRRh7-
Frame ID: 0AE82771C2E8016003EE4E89205770EF
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

FedExFedExFedEx

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

117 kB
Transfer

131 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request j1CXRRh7- Show response www.internetservicetech.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/	21 KB 4 KB	376ms 288ms	Document text/html	54.72.163.41 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.internetservicetech.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/j1CXRRh7- Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.72.163.41 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-72-163-41.eu-west-1.compute.amazonaws.com Software / Resource Hash `32e1c5e5ea28868a56c7e01af375c08853b1c7e1812d54d92245d354eab36e3b` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers date Thu, 09 Dec 2021 13:06:32 GMT content-type text/html; charset=utf-8 content-length 3638 x-amzn-requestid 4949035a-a3b9-4371-994e-168589c297e7 content-encoding br x-amzn-remapped-content-length 3638 x-amz-apigw-id KFTV2EPODoEF4SA= vary Accept-Encoding x-amzn-trace-id Root=1-61b1ff58-3a21ad457da7ea577966af54
GET H2	200	global_wrapper_min.css cloud.phishinsight.trendmicro.com/content/lps/assets/system/css/	48 KB 48 KB	56ms 16ms	Stylesheet text/css	13.32.121.70 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/css/global_wrapper_min.css Requested by Host: www.internetservicetech.com URL: https://www.internetservicetech.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/j1CXRRh7- Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.121.70 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-121-70.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash `0bcb6ef59f1ee238fd8c8ecd0dbbad426d37ab8ee99fd20897885db9f3c28c59` Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.internetservicetech.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers x-amz-server-side-encryption AES256 x-amz-version-id YPQnilzSes27bZ7g1KNI8plIMEFKK91_ via 1.1 d7433132a7c6595c9aab2dc2272e7061.cloudfront.net (CloudFront) last-modified Wed, 01 Dec 2021 01:03:29 GMT server AmazonS3 age 32638 etag "c574d4c3e6c368e811acf28079d2dd85" x-cache Hit from cloudfront content-type text/css date Thu, 09 Dec 2021 04:02:35 GMT x-amz-replication-status COMPLETED x-amz-cf-pop FRA60-P1 accept-ranges bytes content-length 49134 x-amz-cf-id 2Vul98xWd16vftAj9RbDZSscRzMEqe7gsbfOLyyXnqOj5Oksz-Jwew==
GET H2	200	common_min.css cloud.phishinsight.trendmicro.com/content/lps/assets/system/css/	46 KB 46 KB	57ms 17ms	Stylesheet text/css	13.32.121.70 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/css/common_min.css Requested by Host: www.internetservicetech.com URL: https://www.internetservicetech.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/j1CXRRh7- Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.121.70 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-121-70.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash `89f3ceec16b9f3f3a4f66421593740f74f761b515547c63cde83c27b8d58efa1` Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.internetservicetech.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers x-amz-server-side-encryption AES256 x-amz-version-id D5u1REjdAM6AMVhoGxS6xSsj9lhu1Ozo via 1.1 d7433132a7c6595c9aab2dc2272e7061.cloudfront.net (CloudFront) last-modified Wed, 01 Dec 2021 01:03:21 GMT server AmazonS3 age 32638 etag "024477d57d4754e6c61d19c91a6cb79e" x-cache Hit from cloudfront content-type text/css date Thu, 09 Dec 2021 04:02:35 GMT x-amz-replication-status COMPLETED x-amz-cf-pop FRA60-P1 accept-ranges bytes content-length 47049 x-amz-cf-id x6qrqEctdMgyWOaM89F0Th5jHhIlcwsOqRODQFrdA4PgyqbeXoMQ6w==
GET H2	200	logo_header_fedex_gb.png cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/	4 KB 4 KB	72ms 33ms	Image image/png	13.32.121.70 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/logo_header_fedex_gb.png Requested by Host: www.internetservicetech.com URL: https://www.internetservicetech.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/j1CXRRh7- Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.121.70 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-121-70.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash `dec76b4fc63b473795b21e2700cdad4ea574a364651aaa43fed3f0f43ea6b442` Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.internetservicetech.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers x-amz-server-side-encryption AES256 x-amz-version-id up4_CIcEVDKwBnYAigoDf7QtEVhfBfod via 1.1 d7433132a7c6595c9aab2dc2272e7061.cloudfront.net (CloudFront) last-modified Wed, 01 Dec 2021 01:04:43 GMT server AmazonS3 age 8610 etag "2de31c6fc34a8e08154054b25c305962" x-cache Hit from cloudfront content-type image/png date Thu, 09 Dec 2021 10:43:03 GMT x-amz-replication-status COMPLETED x-amz-cf-pop FRA60-P1 accept-ranges bytes content-length 3727 x-amz-cf-id dB_-NCfGG6K8h_FsEv31pYW_KxihKjgWdLfU5a5BlTOHrk9sgUwciA==
GET H2	200	logo_footer_fedex.gif cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/	1 KB 2 KB	68ms 29ms	Image image/gif	13.32.121.70 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/logo_footer_fedex.gif Requested by Host: www.internetservicetech.com URL: https://www.internetservicetech.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/j1CXRRh7- Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.121.70 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-121-70.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash `1c192944e83b1e02fe33b614ba139866c0f81f6f37cfe00add496440b037dc3b` Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.internetservicetech.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers x-amz-server-side-encryption AES256 x-amz-version-id sNXE5cvgPkBQgRLNtKM8AAZD8mu1Crsc via 1.1 d7433132a7c6595c9aab2dc2272e7061.cloudfront.net (CloudFront) last-modified Wed, 01 Dec 2021 01:04:43 GMT server AmazonS3 age 8610 etag "c511f7109470ffe886d41bb3fc1e2e63" x-cache Hit from cloudfront content-type image/gif date Thu, 09 Dec 2021 12:31:37 GMT x-amz-replication-status COMPLETED x-amz-cf-pop FRA60-P1 accept-ranges bytes content-length 1120 x-amz-cf-id YOG4F7-th8NyqEimyox5vJNkO5D7SvuW_SLJOpP6ocbNnM-U9lJwwg==
GET H2	200	gb.gif cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/	260 B 681 B	69ms 30ms	Image image/gif	13.32.121.70 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/gb.gif Requested by Host: www.internetservicetech.com URL: https://www.internetservicetech.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/j1CXRRh7- Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.121.70 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-121-70.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash `4de3ba7104d2c09b0a66c63f2dee198836fcdba8579a404bc797ae95c99efdee` Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.internetservicetech.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers x-amz-server-side-encryption AES256 x-amz-version-id O7YBb_qrR99v3sg50qvpeDRk6U_rP0.U via 1.1 d7433132a7c6595c9aab2dc2272e7061.cloudfront.net (CloudFront) last-modified Wed, 01 Dec 2021 01:04:29 GMT server AmazonS3 age 8610 etag "b68a866f3b54a11cf2fc2b3ce2ea26d5" x-cache Hit from cloudfront content-type image/gif date Thu, 09 Dec 2021 10:43:03 GMT x-amz-replication-status COMPLETED x-amz-cf-pop FRA60-P1 accept-ranges bytes content-length 260 x-amz-cf-id zMKbrjC9DdbppczWKUoDEjBGIeJrBwTaTZynx_OK7ZuTOTSo31Amew==
GET H2	200	bg_page.png cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/	680 B 1 KB	68ms 30ms	Image image/png	13.32.121.70 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/bg_page.png Requested by Host: www.internetservicetech.com URL: https://www.internetservicetech.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/j1CXRRh7- Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.121.70 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-121-70.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash `694639ec3961fdf6810cf74b9792475cab55edc6fda135d18415e7a56995ee0e` Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.internetservicetech.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers x-amz-server-side-encryption AES256 x-amz-version-id Vm7Ckmbj6mWJ4x2yDmD30JpWZqtbh46a via 1.1 d7433132a7c6595c9aab2dc2272e7061.cloudfront.net (CloudFront) last-modified Wed, 01 Dec 2021 01:03:59 GMT server AmazonS3 age 48409 etag "f8666160dd8b6d1555854d73230540b4" x-cache Hit from cloudfront content-type image/png date Wed, 08 Dec 2021 23:39:44 GMT x-amz-replication-status COMPLETED x-amz-cf-pop FRA60-P1 accept-ranges bytes content-length 680 x-amz-cf-id Ig_J_UES4xSrCdo3fud9vOIg2_BjjQaP_f11I5Mu9AYOYthgtoRRAw==
GET H2	200	fedex_assets.png cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/	10 KB 11 KB	13ms 12ms	Image image/png	13.32.121.70 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/fedex_assets.png Requested by Host: www.internetservicetech.com URL: https://www.internetservicetech.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/j1CXRRh7- Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.121.70 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-121-70.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash `f756eddcff80f5e15b6dcf06db53701e978654ed7b6d2da82d6cf5c20b6307b0` Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.internetservicetech.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers x-amz-server-side-encryption AES256 x-amz-version-id gNFN1kOaeTxEXmhkr1TII.XhrRXrFeDF via 1.1 d7433132a7c6595c9aab2dc2272e7061.cloudfront.net (CloudFront) last-modified Wed, 01 Dec 2021 01:04:22 GMT server AmazonS3 age 48409 etag "30e23fe837fd0069d00e00e3e66a1673" x-cache Hit from cloudfront content-type image/png date Wed, 08 Dec 2021 23:39:44 GMT x-amz-replication-status COMPLETED x-amz-cf-pop FRA60-P1 accept-ranges bytes content-length 10554 x-amz-cf-id PqWmzAJoZghjNccr_Dj1eJxGJg1LBw3qy9N9wQmlWgdjlinmFr3fgA==
GET H2	403	assets.png cloud.phishinsight.trendmicro.com/content/lps/assets/system/images/	0 0	137ms 137ms	Image application/xml	13.32.121.70 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/images/assets.png Requested by Host: cloud.phishinsight.trendmicro.com URL: https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/css/global_wrapper_min.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.121.70 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-121-70.fra60.r.cloudfront.net Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept-Language de-DE,de;q=0.9 Referer https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/css/global_wrapper_min.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Fedex (Transportation)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/images/assets.png Message: Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cloud.phishinsight.trendmicro.com
www.internetservicetech.com
13.32.121.70
54.72.163.41
0bcb6ef59f1ee238fd8c8ecd0dbbad426d37ab8ee99fd20897885db9f3c28c59
1c192944e83b1e02fe33b614ba139866c0f81f6f37cfe00add496440b037dc3b
32e1c5e5ea28868a56c7e01af375c08853b1c7e1812d54d92245d354eab36e3b
4de3ba7104d2c09b0a66c63f2dee198836fcdba8579a404bc797ae95c99efdee
694639ec3961fdf6810cf74b9792475cab55edc6fda135d18415e7a56995ee0e
89f3ceec16b9f3f3a4f66421593740f74f761b515547c63cde83c27b8d58efa1
dec76b4fc63b473795b21e2700cdad4ea574a364651aaa43fed3f0f43ea6b442
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f756eddcff80f5e15b6dcf06db53701e978654ed7b6d2da82d6cf5c20b6307b0

www.internetservicetech.com Open in urlscan Pro 54.72.163.41 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

117 kBTransfer

131 kBSize

0 Cookies

0 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

www.internetservicetech.com Open in urlscan Pro
54.72.163.41 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

117 kB
Transfer

131 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!