www.onlineservicetec.com Open in urlscan Pro
52.17.45.222 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.onlineservicetec.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/LTzwqQVaoAvIuWcknt3RKuvQ6PIIS4sCHrtiqwaN470
Submission: On November 05 via automatic, source openphish (November 5th 2021, 1:08:57 pm UTC) — Scanned from DE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 52.17.45.222, located in Dublin, Ireland and belongs to AMAZON-02, US. The main domain is www.onlineservicetec.com.
TLS certificate: Issued by Amazon on December 11th 2020. Valid for: a year.

This is the only time www.onlineservicetec.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Fedex (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1	52.17.45.222 52.17.45.222	16509 (AMAZON-02) (AMAZON-02)
8	13.32.22.38 13.32.22.38	16509 (AMAZON-02) (AMAZON-02)
9	2

1 52.17.45.222 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-17-45-222.eu-west-1.compute.amazonaws.com

www.onlineservicetec.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 13.32.22.38 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-22-38.fra56.r.cloudfront.net

cloud.phishinsight.trendmicro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	trendmicro.com cloud.phishinsight.trendmicro.com	113 KB
1	onlineservicetec.com www.onlineservicetec.com	4 KB
9	2

	Domain	Requested by
8	cloud.phishinsight.trendmicro.com	www.onlineservicetec.com cloud.phishinsight.trendmicro.com
1	www.onlineservicetec.com
9	2

This site contains no links.

Subject Issuer	Validity	Valid
*.onlineservicetec.com Amazon	`2020-12-11` - `2022-01-09`	a year	crt.sh
*.phishinsight.trendmicro.com Entrust Certification Authority - L1K	`2020-07-07` - `2022-07-06`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://www.onlineservicetec.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/LTzwqQVaoAvIuWcknt3RKuvQ6PIIS4sCHrtiqwaN470
Frame ID: 4EE57FCAD931FB5D75CAE58C5E236C27
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

FedExFedExFedEx

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

117 kB
Transfer

129 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request LTzwqQVaoAvIuWcknt3RKuvQ6PIIS4sCHrtiqwaN470 Show response www.onlineservicetec.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/	20 KB 4 KB	425ms 325ms	Document text/html	52.17.45.222 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.onlineservicetec.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/LTzwqQVaoAvIuWcknt3RKuvQ6PIIS4sCHrtiqwaN470 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.17.45.222 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-17-45-222.eu-west-1.compute.amazonaws.com Software / Resource Hash `dfa155e1b2ca7398d0e43ad509efea001352600934c3ccfc215e4c47940f48b7` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers date Fri, 05 Nov 2021 13:08:53 GMT content-type text/html; charset=utf-8 content-length 3643 x-amzn-requestid dd87e04f-3002-45db-a6b7-0b645212c3a1 content-encoding br x-amzn-remapped-content-length 3643 x-amz-apigw-id IVPzzHE7DoEFeAg= vary Accept-Encoding x-amzn-trace-id Root=1-61852ce4-2019f6886e6bf93724a213d4
GET H2	200	global_wrapper_min.css cloud.phishinsight.trendmicro.com/content/lps/assets/system/css/	48 KB 48 KB	71ms 18ms	Stylesheet text/css	13.32.22.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/css/global_wrapper_min.css Requested by Host: www.onlineservicetec.com URL: https://www.onlineservicetec.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/LTzwqQVaoAvIuWcknt3RKuvQ6PIIS4sCHrtiqwaN470 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.22.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-22-38.fra56.r.cloudfront.net Software AmazonS3 / Resource Hash `0bcb6ef59f1ee238fd8c8ecd0dbbad426d37ab8ee99fd20897885db9f3c28c59` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Thu, 04 Nov 2021 16:42:38 GMT via 1.1 b25bc331cb2e5e7e25d9488f5ecdc941.cloudfront.net (CloudFront) last-modified Thu, 07 Oct 2021 01:19:04 GMT server AmazonS3 age 73576 etag "c574d4c3e6c368e811acf28079d2dd85" x-cache Hit from cloudfront x-amz-version-id hQrUMRKdlc3FXO0DT3lxZn3SPCGvha3G x-amz-replication-status COMPLETED x-amz-cf-pop FRA56-C2 accept-ranges bytes content-type text/css content-length 49134 x-amz-cf-id zQCBsvgp6zcgHGASsweQe0OIbIH0cTB5gBUODmxzjt1BSA-WICSqLA==
GET H2	200	common_min.css cloud.phishinsight.trendmicro.com/content/lps/assets/system/css/	46 KB 46 KB	66ms 13ms	Stylesheet text/css	13.32.22.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/css/common_min.css Requested by Host: www.onlineservicetec.com URL: https://www.onlineservicetec.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/LTzwqQVaoAvIuWcknt3RKuvQ6PIIS4sCHrtiqwaN470 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.22.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-22-38.fra56.r.cloudfront.net Software AmazonS3 / Resource Hash `89f3ceec16b9f3f3a4f66421593740f74f761b515547c63cde83c27b8d58efa1` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Thu, 04 Nov 2021 16:42:38 GMT via 1.1 b25bc331cb2e5e7e25d9488f5ecdc941.cloudfront.net (CloudFront) last-modified Thu, 07 Oct 2021 01:18:57 GMT server AmazonS3 age 73576 etag "024477d57d4754e6c61d19c91a6cb79e" x-cache Hit from cloudfront x-amz-version-id AZZkxDIMean.jWn4vELITcQ.S0zVxSrm x-amz-replication-status COMPLETED x-amz-cf-pop FRA56-C2 accept-ranges bytes content-type text/css content-length 47049 x-amz-cf-id oQ1dl7JNEDCZz5OZkOHc5rG6KiOknOjCFdsD2YIIFXWaWwbUjCZElg==
GET H2	200	logo_header_fedex_gb.png cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/	4 KB 4 KB	77ms 25ms	Image image/png	13.32.22.38 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/logo_header_fedex_gb.png Requested by Host: www.onlineservicetec.com URL: https://www.onlineservicetec.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/LTzwqQVaoAvIuWcknt3RKuvQ6PIIS4sCHrtiqwaN470 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.22.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-22-38.fra56.r.cloudfront.net Software AmazonS3 / Resource Hash `dec76b4fc63b473795b21e2700cdad4ea574a364651aaa43fed3f0f43ea6b442` Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.onlineservicetec.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers x-amz-server-side-encryption AES256 x-amz-version-id hRdhf_UFsFn1A3IO9YhleiCTzdqdzE_O via 1.1 b25bc331cb2e5e7e25d9488f5ecdc941.cloudfront.net (CloudFront) last-modified Thu, 07 Oct 2021 01:20:15 GMT server AmazonS3 x-amz-cf-pop FRA56-C2 etag "2de31c6fc34a8e08154054b25c305962" x-cache Hit from cloudfront content-type image/png date Fri, 05 Nov 2021 13:08:53 GMT x-amz-replication-status COMPLETED accept-ranges bytes content-length 3727 x-amz-cf-id RylXboTL4dhhJdFob36uZGvZWpVx51qC4IQYJ3IDcbDuZ4eGmO9OXg==
GET H2	200	logo_footer_fedex.gif cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/	1 KB 2 KB	69ms 18ms	Image image/gif	13.32.22.38 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/logo_footer_fedex.gif Requested by Host: www.onlineservicetec.com URL: https://www.onlineservicetec.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/LTzwqQVaoAvIuWcknt3RKuvQ6PIIS4sCHrtiqwaN470 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.22.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-22-38.fra56.r.cloudfront.net Software AmazonS3 / Resource Hash `1c192944e83b1e02fe33b614ba139866c0f81f6f37cfe00add496440b037dc3b` Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.onlineservicetec.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers x-amz-server-side-encryption AES256 x-amz-version-id BUMWIrXU7oyssXa2tvBCXAU_kKxs.nAC via 1.1 b25bc331cb2e5e7e25d9488f5ecdc941.cloudfront.net (CloudFront) last-modified Thu, 07 Oct 2021 01:20:15 GMT server AmazonS3 x-amz-cf-pop FRA56-C2 etag "c511f7109470ffe886d41bb3fc1e2e63" x-cache Hit from cloudfront content-type image/gif date Fri, 05 Nov 2021 13:08:53 GMT x-amz-replication-status COMPLETED accept-ranges bytes content-length 1120 x-amz-cf-id -fdcmoatsvHSRq_7J_vRbgG-zg1bDqnm0KkAnQxruqfU2ot8216hVQ==
GET H2	200	gb.gif cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/	260 B 673 B	69ms 17ms	Image image/gif	13.32.22.38 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/gb.gif Requested by Host: www.onlineservicetec.com URL: https://www.onlineservicetec.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/LTzwqQVaoAvIuWcknt3RKuvQ6PIIS4sCHrtiqwaN470 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.22.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-22-38.fra56.r.cloudfront.net Software AmazonS3 / Resource Hash `4de3ba7104d2c09b0a66c63f2dee198836fcdba8579a404bc797ae95c99efdee` Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.onlineservicetec.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers x-amz-server-side-encryption AES256 x-amz-version-id OAn0hEA36lx2ZsTJn5BhIOl7NWCi2kpA via 1.1 b25bc331cb2e5e7e25d9488f5ecdc941.cloudfront.net (CloudFront) last-modified Thu, 07 Oct 2021 01:20:02 GMT server AmazonS3 x-amz-cf-pop FRA56-C2 etag "b68a866f3b54a11cf2fc2b3ce2ea26d5" x-cache Hit from cloudfront content-type image/gif date Fri, 05 Nov 2021 13:08:53 GMT x-amz-replication-status COMPLETED accept-ranges bytes content-length 260 x-amz-cf-id dGeMJ74VMSEkMf-uXwy7xE1FubroAsuosDxX-OfSpy4pEmWJ3lyhlQ==
GET H2	200	bg_page.png cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/	680 B 1 KB	69ms 18ms	Image image/png	13.32.22.38 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/bg_page.png Requested by Host: www.onlineservicetec.com URL: https://www.onlineservicetec.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/LTzwqQVaoAvIuWcknt3RKuvQ6PIIS4sCHrtiqwaN470 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.22.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-22-38.fra56.r.cloudfront.net Software AmazonS3 / Resource Hash `694639ec3961fdf6810cf74b9792475cab55edc6fda135d18415e7a56995ee0e` Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.onlineservicetec.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers x-amz-server-side-encryption AES256 x-amz-version-id 2isjAZwVrNp6hxklNQlzW4ZUsO3EcGsX via 1.1 b25bc331cb2e5e7e25d9488f5ecdc941.cloudfront.net (CloudFront) last-modified Thu, 07 Oct 2021 01:19:34 GMT server AmazonS3 x-amz-cf-pop FRA56-C2 etag "f8666160dd8b6d1555854d73230540b4" x-cache Hit from cloudfront content-type image/png date Fri, 05 Nov 2021 13:08:53 GMT x-amz-replication-status COMPLETED accept-ranges bytes content-length 680 x-amz-cf-id gYRX1PkqEhTg9zTjdeJ986eAm6LZz19Wbcu9rjxTETI4Ss4Mxn9Njw==
GET H2	200	fedex_assets.png cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/	10 KB 11 KB	13ms 13ms	Image image/png	13.32.22.38 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/fedex_assets.png Requested by Host: www.onlineservicetec.com URL: https://www.onlineservicetec.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/LTzwqQVaoAvIuWcknt3RKuvQ6PIIS4sCHrtiqwaN470 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.22.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-22-38.fra56.r.cloudfront.net Software AmazonS3 / Resource Hash `f756eddcff80f5e15b6dcf06db53701e978654ed7b6d2da82d6cf5c20b6307b0` Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.onlineservicetec.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers x-amz-server-side-encryption AES256 x-amz-version-id rkHEUZxvfB9bPqqJRUFrnidIa_kXgMsA via 1.1 b25bc331cb2e5e7e25d9488f5ecdc941.cloudfront.net (CloudFront) last-modified Thu, 07 Oct 2021 01:19:54 GMT server AmazonS3 x-amz-cf-pop FRA56-C2 etag "30e23fe837fd0069d00e00e3e66a1673" x-cache Hit from cloudfront content-type image/png date Fri, 05 Nov 2021 13:08:53 GMT x-amz-replication-status COMPLETED accept-ranges bytes content-length 10554 x-amz-cf-id BnLEnVGHI5yOVkN0a80oV4rB31ZtX7acSs_bRNg06Mmg_Imc0BVlcA==
GET H2	403	assets.png cloud.phishinsight.trendmicro.com/content/lps/assets/system/images/	0 0	144ms 143ms	Image application/xml	13.32.22.38 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/images/assets.png Requested by Host: cloud.phishinsight.trendmicro.com URL: https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/css/global_wrapper_min.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.22.38 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-22-38.fra56.r.cloudfront.net Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept-Language de-DE,de;q=0.9 Referer https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/css/global_wrapper_min.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Fedex (Transportation)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/images/assets.png Message: Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cloud.phishinsight.trendmicro.com
www.onlineservicetec.com
13.32.22.38
52.17.45.222
0bcb6ef59f1ee238fd8c8ecd0dbbad426d37ab8ee99fd20897885db9f3c28c59
1c192944e83b1e02fe33b614ba139866c0f81f6f37cfe00add496440b037dc3b
4de3ba7104d2c09b0a66c63f2dee198836fcdba8579a404bc797ae95c99efdee
694639ec3961fdf6810cf74b9792475cab55edc6fda135d18415e7a56995ee0e
89f3ceec16b9f3f3a4f66421593740f74f761b515547c63cde83c27b8d58efa1
dec76b4fc63b473795b21e2700cdad4ea574a364651aaa43fed3f0f43ea6b442
dfa155e1b2ca7398d0e43ad509efea001352600934c3ccfc215e4c47940f48b7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f756eddcff80f5e15b6dcf06db53701e978654ed7b6d2da82d6cf5c20b6307b0

www.onlineservicetec.com Open in urlscan Pro 52.17.45.222 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

117 kBTransfer

129 kBSize

0 Cookies

0 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

www.onlineservicetec.com Open in urlscan Pro
52.17.45.222 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

117 kB
Transfer

129 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!