www.eservicebits.com Open in urlscan Pro
52.49.22.108 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.eservicebits.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/4LTkY-LJAor1nGZlcMg58ps8e_SAU91fmJWFLgYySbs
Submission: On November 09 via manual (November 9th 2021, 6:31:59 pm UTC) from US — Scanned from DE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 52.49.22.108, located in Dublin, Ireland and belongs to AMAZON-02, US. The main domain is www.eservicebits.com.
TLS certificate: Issued by Amazon on April 29th 2021. Valid for: a year.

This is the only time www.eservicebits.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Fedex (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1	52.49.22.108 52.49.22.108	16509 (AMAZON-02) (AMAZON-02)
8	143.204.98.11 143.204.98.11	16509 (AMAZON-02) (AMAZON-02)
9	2

1 52.49.22.108 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-49-22-108.eu-west-1.compute.amazonaws.com

www.eservicebits.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 143.204.98.11 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-11.fra50.r.cloudfront.net

cloud.phishinsight.trendmicro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	trendmicro.com cloud.phishinsight.trendmicro.com	113 KB
1	eservicebits.com www.eservicebits.com	4 KB
9	2

	Domain	Requested by
8	cloud.phishinsight.trendmicro.com	www.eservicebits.com cloud.phishinsight.trendmicro.com
1	www.eservicebits.com
9	2

This site contains no links.

Subject Issuer	Validity	Valid
*.onlineservicegroup.net Amazon	`2021-04-29` - `2022-05-28`	a year	crt.sh
*.phishinsight.trendmicro.com Entrust Certification Authority - L1K	`2020-07-07` - `2022-07-06`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://www.eservicebits.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/4LTkY-LJAor1nGZlcMg58ps8e_SAU91fmJWFLgYySbs
Frame ID: 6BA1E0E8A869901710E898170A83F12A
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

FedExFedExFedEx

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

117 kB
Transfer

129 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request 4LTkY-LJAor1nGZlcMg58ps8e_SAU91fmJWFLgYySbs Show response www.eservicebits.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/	20 KB 4 KB	507ms 435ms	Document text/html	52.49.22.108 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.eservicebits.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/4LTkY-LJAor1nGZlcMg58ps8e_SAU91fmJWFLgYySbs Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.49.22.108 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-49-22-108.eu-west-1.compute.amazonaws.com Software / Resource Hash `c124aa16cabe3fd941a1d52a8b5dd428a202fff4ea726dd453ec93bb8e4e7773` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers date Tue, 09 Nov 2021 18:31:54 GMT content-type text/html; charset=utf-8 content-length 3644 x-amzn-requestid a5ffc5f5-d09d-40d3-93ec-03731c360da9 content-encoding br x-amzn-remapped-content-length 3644 x-amz-apigw-id IjK4KHRIDoEFUQw= vary Accept-Encoding x-amzn-trace-id Root=1-618abe9a-57f80c62208dca203d4d2c09
GET H2	200	global_wrapper_min.css cloud.phishinsight.trendmicro.com/content/lps/assets/system/css/	48 KB 48 KB	62ms 27ms	Stylesheet text/css	143.204.98.11 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/css/global_wrapper_min.css Requested by Host: www.eservicebits.com URL: https://www.eservicebits.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/4LTkY-LJAor1nGZlcMg58ps8e_SAU91fmJWFLgYySbs Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.11 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-11.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash `0bcb6ef59f1ee238fd8c8ecd0dbbad426d37ab8ee99fd20897885db9f3c28c59` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Tue, 09 Nov 2021 13:34:55 GMT via 1.1 009e5e3e32afcd1d135a7234c9da5521.cloudfront.net (CloudFront) last-modified Thu, 07 Oct 2021 01:19:04 GMT server AmazonS3 age 17820 etag "c574d4c3e6c368e811acf28079d2dd85" x-cache Hit from cloudfront x-amz-version-id hQrUMRKdlc3FXO0DT3lxZn3SPCGvha3G x-amz-replication-status COMPLETED x-amz-cf-pop FRA50-C1 accept-ranges bytes content-type text/css content-length 49134 x-amz-cf-id mIAg0XH9mXqckHFPY6Hyc_x7ocbCjDCm3dPMi-__7ggvnPY7tC9Xuw==
GET H2	200	common_min.css cloud.phishinsight.trendmicro.com/content/lps/assets/system/css/	46 KB 46 KB	56ms 22ms	Stylesheet text/css	143.204.98.11 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/css/common_min.css Requested by Host: www.eservicebits.com URL: https://www.eservicebits.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/4LTkY-LJAor1nGZlcMg58ps8e_SAU91fmJWFLgYySbs Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.11 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-11.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash `89f3ceec16b9f3f3a4f66421593740f74f761b515547c63cde83c27b8d58efa1` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Tue, 09 Nov 2021 13:34:55 GMT via 1.1 009e5e3e32afcd1d135a7234c9da5521.cloudfront.net (CloudFront) last-modified Thu, 07 Oct 2021 01:18:57 GMT server AmazonS3 age 17820 etag "024477d57d4754e6c61d19c91a6cb79e" x-cache Hit from cloudfront x-amz-version-id AZZkxDIMean.jWn4vELITcQ.S0zVxSrm x-amz-replication-status COMPLETED x-amz-cf-pop FRA50-C1 accept-ranges bytes content-type text/css content-length 47049 x-amz-cf-id e4okaHKILnDlefYTJZOnUBH-Goz9fyYgPQ7Mi1GMpXYILdQX2eiWfg==
GET H2	200	logo_header_fedex_gb.png cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/	4 KB 4 KB	50ms 16ms	Image image/png	143.204.98.11 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/logo_header_fedex_gb.png Requested by Host: www.eservicebits.com URL: https://www.eservicebits.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/4LTkY-LJAor1nGZlcMg58ps8e_SAU91fmJWFLgYySbs Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.11 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-11.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash `dec76b4fc63b473795b21e2700cdad4ea574a364651aaa43fed3f0f43ea6b442` Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.eservicebits.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers x-amz-server-side-encryption AES256 x-amz-version-id hRdhf_UFsFn1A3IO9YhleiCTzdqdzE_O via 1.1 009e5e3e32afcd1d135a7234c9da5521.cloudfront.net (CloudFront) last-modified Thu, 07 Oct 2021 01:20:15 GMT server AmazonS3 age 17820 etag "2de31c6fc34a8e08154054b25c305962" x-cache Hit from cloudfront content-type image/png date Tue, 09 Nov 2021 13:34:55 GMT x-amz-replication-status COMPLETED x-amz-cf-pop FRA50-C1 accept-ranges bytes content-length 3727 x-amz-cf-id QSbAy1d1t6xSTQMe8IsYE61UQUxAjfrPRHfHEg6Yd9Us6vKYm9nrFA==
GET H2	200	logo_footer_fedex.gif cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/	1 KB 2 KB	51ms 17ms	Image image/gif	143.204.98.11 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/logo_footer_fedex.gif Requested by Host: www.eservicebits.com URL: https://www.eservicebits.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/4LTkY-LJAor1nGZlcMg58ps8e_SAU91fmJWFLgYySbs Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.11 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-11.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash `1c192944e83b1e02fe33b614ba139866c0f81f6f37cfe00add496440b037dc3b` Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.eservicebits.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers x-amz-server-side-encryption AES256 x-amz-version-id BUMWIrXU7oyssXa2tvBCXAU_kKxs.nAC via 1.1 009e5e3e32afcd1d135a7234c9da5521.cloudfront.net (CloudFront) last-modified Thu, 07 Oct 2021 01:20:15 GMT server AmazonS3 age 17820 etag "c511f7109470ffe886d41bb3fc1e2e63" x-cache Hit from cloudfront content-type image/gif date Tue, 09 Nov 2021 13:34:55 GMT x-amz-replication-status COMPLETED x-amz-cf-pop FRA50-C1 accept-ranges bytes content-length 1120 x-amz-cf-id hnjIvvnLbXbmqgekuABq-QsD89o0WpngLm1sUADWnQYHSQSr_8G83g==
GET H2	200	gb.gif cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/	260 B 680 B	65ms 31ms	Image image/gif	143.204.98.11 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/gb.gif Requested by Host: www.eservicebits.com URL: https://www.eservicebits.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/4LTkY-LJAor1nGZlcMg58ps8e_SAU91fmJWFLgYySbs Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.11 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-11.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash `4de3ba7104d2c09b0a66c63f2dee198836fcdba8579a404bc797ae95c99efdee` Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.eservicebits.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers x-amz-server-side-encryption AES256 x-amz-version-id OAn0hEA36lx2ZsTJn5BhIOl7NWCi2kpA via 1.1 009e5e3e32afcd1d135a7234c9da5521.cloudfront.net (CloudFront) last-modified Thu, 07 Oct 2021 01:20:02 GMT server AmazonS3 age 17820 etag "b68a866f3b54a11cf2fc2b3ce2ea26d5" x-cache Hit from cloudfront content-type image/gif date Tue, 09 Nov 2021 13:34:55 GMT x-amz-replication-status COMPLETED x-amz-cf-pop FRA50-C1 accept-ranges bytes content-length 260 x-amz-cf-id bKR_c_l6vShrbyo4MZ2u6_WnadeBoMQQhsqZyQbLrb_CumnmNqqr7g==
GET H2	200	bg_page.png cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/	680 B 1 KB	55ms 22ms	Image image/png	143.204.98.11 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/bg_page.png Requested by Host: www.eservicebits.com URL: https://www.eservicebits.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/4LTkY-LJAor1nGZlcMg58ps8e_SAU91fmJWFLgYySbs Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.11 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-11.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash `694639ec3961fdf6810cf74b9792475cab55edc6fda135d18415e7a56995ee0e` Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.eservicebits.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers x-amz-server-side-encryption AES256 x-amz-version-id 2isjAZwVrNp6hxklNQlzW4ZUsO3EcGsX via 1.1 009e5e3e32afcd1d135a7234c9da5521.cloudfront.net (CloudFront) last-modified Thu, 07 Oct 2021 01:19:34 GMT server AmazonS3 age 17820 etag "f8666160dd8b6d1555854d73230540b4" x-cache Hit from cloudfront content-type image/png date Tue, 09 Nov 2021 13:34:55 GMT x-amz-replication-status COMPLETED x-amz-cf-pop FRA50-C1 accept-ranges bytes content-length 680 x-amz-cf-id QExRZFrxis-8iKOD-ee_XbfbzPnIElpn2cMfmcg-cjvMc13NOzx3Dw==
GET H2	200	fedex_assets.png cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/	10 KB 11 KB	18ms 17ms	Image image/png	143.204.98.11 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/fedex_assets.png Requested by Host: www.eservicebits.com URL: https://www.eservicebits.com/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/4LTkY-LJAor1nGZlcMg58ps8e_SAU91fmJWFLgYySbs Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.11 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-11.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash `f756eddcff80f5e15b6dcf06db53701e978654ed7b6d2da82d6cf5c20b6307b0` Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.eservicebits.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers x-amz-server-side-encryption AES256 x-amz-version-id rkHEUZxvfB9bPqqJRUFrnidIa_kXgMsA via 1.1 009e5e3e32afcd1d135a7234c9da5521.cloudfront.net (CloudFront) last-modified Thu, 07 Oct 2021 01:19:54 GMT server AmazonS3 age 17819 etag "30e23fe837fd0069d00e00e3e66a1673" x-cache Hit from cloudfront content-type image/png date Tue, 09 Nov 2021 13:34:55 GMT x-amz-replication-status COMPLETED x-amz-cf-pop FRA50-C1 accept-ranges bytes content-length 10554 x-amz-cf-id nPsa4DScM7S_OmNTY-vsud0rWWx-olJui3NPOQg8ctlgMNV5dj0vFg==
GET H2	403	assets.png cloud.phishinsight.trendmicro.com/content/lps/assets/system/images/	0 0	147ms 147ms	Image application/xml	143.204.98.11 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/images/assets.png Requested by Host: cloud.phishinsight.trendmicro.com URL: https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/css/global_wrapper_min.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.11 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-11.fra50.r.cloudfront.net Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept-Language de-DE,de;q=0.9 Referer https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/css/global_wrapper_min.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Fedex (Transportation)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/images/assets.png Message: Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cloud.phishinsight.trendmicro.com
www.eservicebits.com
143.204.98.11
52.49.22.108
0bcb6ef59f1ee238fd8c8ecd0dbbad426d37ab8ee99fd20897885db9f3c28c59
1c192944e83b1e02fe33b614ba139866c0f81f6f37cfe00add496440b037dc3b
4de3ba7104d2c09b0a66c63f2dee198836fcdba8579a404bc797ae95c99efdee
694639ec3961fdf6810cf74b9792475cab55edc6fda135d18415e7a56995ee0e
89f3ceec16b9f3f3a4f66421593740f74f761b515547c63cde83c27b8d58efa1
c124aa16cabe3fd941a1d52a8b5dd428a202fff4ea726dd453ec93bb8e4e7773
dec76b4fc63b473795b21e2700cdad4ea574a364651aaa43fed3f0f43ea6b442
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f756eddcff80f5e15b6dcf06db53701e978654ed7b6d2da82d6cf5c20b6307b0

www.eservicebits.com Open in urlscan Pro 52.49.22.108 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

117 kBTransfer

129 kBSize

0 Cookies

0 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

www.eservicebits.com Open in urlscan Pro
52.49.22.108 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

117 kB
Transfer

129 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!