www.eservicebits.com Open in urlscan Pro
18.173.154.115 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.eservicebits.com/landingpages/939c66c5-a2e6-4d48-93bb-6fda5e52ed17/IpwxRbVZ0aZc3yagopFTr-8tV6ehjo9UpAHEzMbVKhA
Submission: On June 16 via api (June 16th 2024, 1:40:03 am UTC) from LU — Scanned from DE

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 15 HTTP transactions. The main IP is 18.173.154.115, located in United States and belongs to AMAZON-02, US. The main domain is www.eservicebits.com.
TLS certificate: Issued by Amazon RSA 2048 M02 on November 7th 2023. Valid for: a year.

This is the only time www.eservicebits.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
2	18.173.154.115 18.173.154.115	16509 (AMAZON-02) (AMAZON-02)
9	18.173.154.59 18.173.154.59	16509 (AMAZON-02) (AMAZON-02)
15	3

2 18.173.154.115 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-154-115.muc50.r.cloudfront.net

www.eservicebits.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 18.173.154.59 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-154-59.muc50.r.cloudfront.net

cloud.phishinsight.trendmicro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	trendmicro.com cloud.phishinsight.trendmicro.com	1 MB
2	eservicebits.com www.eservicebits.com	14 KB
15	2

	Domain	Requested by
9	cloud.phishinsight.trendmicro.com	client www.eservicebits.com
2	www.eservicebits.com
15	2

This site contains no links.

Subject Issuer	Validity	Valid
eservicebits.com Amazon RSA 2048 M02	`2023-11-07` - `2024-12-05`	a year	crt.sh
*.phishinsight.trendmicro.com Entrust Certification Authority - L1K	`2023-07-18` - `2024-08-17`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.eservicebits.com/landingpages/939c66c5-a2e6-4d48-93bb-6fda5e52ed17/IpwxRbVZ0aZc3yagopFTr-8tV6ehjo9UpAHEzMbVKhA
Frame ID: 7A92134A96DA86ED1A712EE1514A0F40
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Global Logistics | DHL

Page Statistics

15
Requests

73 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

1081 kB
Transfer

1234 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request IpwxRbVZ0aZc3yagopFTr-8tV6ehjo9UpAHEzMbVKhA Show response
www.eservicebits.com/landingpages/939c66c5-a2e6-4d48-93bb-6fda5e52ed17/ 172 KB
13 KB 915ms
868ms Document
text/html 18.173.154.115
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.eservicebits.com/landingpages/939c66c5-a2e6-4d48-93bb-6fda5e52ed17/IpwxRbVZ0aZc3yagopFTr-8tV6ehjo9UpAHEzMbVKhA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.154.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-154-115.muc50.r.cloudfront.net
Software: /
Resource Hash: 30e04c10fe07ca5418298fe379bc7d26c4f597478d976a4c21cb0eabf61edb87

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.38 Safari/537.36

Response headers

content-encoding: br
content-length: 13333
content-type: text/html; charset=utf-8
date: Sun, 16 Jun 2024 01:39:58 GMT
vary: Accept-Encoding
via: 1.1 cb7ecd2473bf95a71af8d1ff8d1034fa.cloudfront.net (CloudFront)
x-amz-apigw-id: Zb9ROELADoEEsmA=
x-amz-cf-id: 8he4NTeTsjTUGzERHTpSXIuwgpqY7v7X5utGZnBifCz-vlhZ3GNOdw==
x-amz-cf-pop: MUC50-P3
x-amzn-remapped-content-length: 13333
x-amzn-requestid: 0361fb81-f349-453b-b66e-9172366a285c
x-amzn-trace-id: Root=1-666e426d-508dad2524fd14f528efc076
x-cache: Miss from cloudfront

GET
H2 200 ewf_base.dae7e8ebce001d436791f9f4d23155d71a0df53c12165ed847468180dd045cb3.css
cloud.phishinsight.trendmicro.com/content/lps/assets/system/css/ 281 KB
282 KB 110ms
66ms Stylesheet
text/css 18.173.154.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/css/ewf_base.dae7e8ebce001d436791f9f4d23155d71a0df53c12165ed847468180dd045cb3.css

Requested by

Host: client
URL: about:client

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.173.154.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-173-154-59.muc50.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

98f0d6326d2bbc3910ca8a33a97320be5830b5953d98a11d0aa302e4955c77ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.eservicebits.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.38 Safari/537.36

Response headers

x-amz-version-id: 9jGTxNjOvE0rcQj.QHEvYfsTQyxMsvOX
date: Sat, 15 Jun 2024 09:33:35 GMT
via: 1.1 106a2e3801afa4dfd5bd4bfaeb93d526.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: MUC50-P3
age: 57984
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 287819
last-modified: Wed, 29 Mar 2023 03:32:39 GMT
server: AmazonS3
etag: "ea34c06e0a9e22bc064bfce50c64da58"
content-type: text/css
accept-ranges: bytes
x-amz-cf-id: v8f0jRY91j_0bG6Q6yxJIUZgTZztdqJeHqr60xelDa2ACuEeDCXjMA==

GET
H2 200 ewf_components.0630161e47cb64c83b67a48f1c3892171e39f60aa62a2edeceda8375e546bcdc.css
cloud.phishinsight.trendmicro.com/content/lps/assets/system/css/ 254 KB
255 KB 72ms
27ms Stylesheet
text/css 18.173.154.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/css/ewf_components.0630161e47cb64c83b67a48f1c3892171e39f60aa62a2edeceda8375e546bcdc.css

Requested by

Host: client
URL: about:client

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.173.154.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-173-154-59.muc50.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

118751357eaa919071d159c4d1e2f2986d41202f78c8778f22ca65766817c939

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.eservicebits.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.38 Safari/537.36

Response headers

x-amz-version-id: k8eov9xjM7Q37IjrGl7h260_ObttVBOJ
date: Sat, 15 Jun 2024 09:33:35 GMT
via: 1.1 106a2e3801afa4dfd5bd4bfaeb93d526.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: MUC50-P3
age: 57984
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 260226
last-modified: Wed, 29 Mar 2023 03:32:40 GMT
server: AmazonS3
etag: "295e6f39d1095e97c49abc868870f29f"
content-type: text/css
accept-ranges: bytes
x-amz-cf-id: BS55GepF13lWi9RcVXerEL3Xq1nlPQbccFJLFfYpUuW8ybvKuikGHw==

GET
H2 200 ewf_cosmetic.b58565c38476d68a546119d65a2c1c3f8b4950ec1516e0bb57f3421eca576d65.css
cloud.phishinsight.trendmicro.com/content/lps/assets/system/css/ 6 KB
7 KB 124ms
80ms Stylesheet
text/css 18.173.154.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/css/ewf_cosmetic.b58565c38476d68a546119d65a2c1c3f8b4950ec1516e0bb57f3421eca576d65.css

Requested by

Host: client
URL: about:client

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.173.154.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-173-154-59.muc50.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

b58565c38476d68a546119d65a2c1c3f8b4950ec1516e0bb57f3421eca576d65

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.eservicebits.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.38 Safari/537.36

Response headers

x-amz-version-id: xptfb8TPFeJ7NaF0Ip_XHnHNwedJiywK
date: Sat, 15 Jun 2024 09:33:35 GMT
via: 1.1 106a2e3801afa4dfd5bd4bfaeb93d526.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: MUC50-P3
age: 57984
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 6644
last-modified: Wed, 29 Mar 2023 03:32:40 GMT
server: AmazonS3
etag: "5ae3470b1e0b63adb68e47640fa6e010"
content-type: text/css
accept-ranges: bytes
x-amz-cf-id: VWvLk-dx7X-QaiUPMls-hPycjPAodxIQ_RX5jTyd_3LkvHQWIzMuWg==

GET
H2 200 dhl_express_logo_transparent.png
cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/ 2 KB
2 KB 36ms
35ms Image
image/png 18.173.154.59
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/dhl_express_logo_transparent.png

Requested by

Host: www.eservicebits.com
URL: https://www.eservicebits.com/landingpages/939c66c5-a2e6-4d48-93bb-6fda5e52ed17/IpwxRbVZ0aZc3yagopFTr-8tV6ehjo9UpAHEzMbVKhA

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.173.154.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-173-154-59.muc50.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

35b8eca53271516f3d66a3dd8f89e1366edb87adad26015424148de71dfcce46

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.eservicebits.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.38 Safari/537.36

Response headers

x-amz-version-id: soNKRu7GYmLy9pAF8lKsGkStthuK10pY
date: Sat, 15 Jun 2024 09:33:35 GMT
via: 1.1 106a2e3801afa4dfd5bd4bfaeb93d526.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: MUC50-P3
age: 57984
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 1940
last-modified: Wed, 29 Mar 2023 03:33:00 GMT
server: AmazonS3
etag: "9c26f4919a06da407b599a871e63d6ff"
content-type: image/png
accept-ranges: bytes
x-amz-cf-id: cxQDK6_llnu3g_HwCL2H4_VIH5EctfKK-GMP6ehYH-3ucOTUMwdHRw==

GET
H2 200 logout_image.png
cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/ 125 KB
126 KB 37ms
37ms Image
image/png 18.173.154.59
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/logout_image.png

Requested by

Host: www.eservicebits.com
URL: https://www.eservicebits.com/landingpages/939c66c5-a2e6-4d48-93bb-6fda5e52ed17/IpwxRbVZ0aZc3yagopFTr-8tV6ehjo9UpAHEzMbVKhA

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.173.154.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-173-154-59.muc50.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

bec410bdccc6b1342258f0aa17fb3ddf86a362141a485a44a85b4da078804201

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.eservicebits.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.38 Safari/537.36

Response headers

x-amz-version-id: jRyLLbTmzP28ailsn108xx_sjIv3aSaP
date: Sat, 15 Jun 2024 09:33:35 GMT
via: 1.1 106a2e3801afa4dfd5bd4bfaeb93d526.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: MUC50-P3
age: 57984
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 128091
last-modified: Wed, 29 Mar 2023 03:33:23 GMT
server: AmazonS3
etag: "24e4fdd37d5a997b6448be887968fdf4"
content-type: image/png
accept-ranges: bytes
x-amz-cf-id: 7qs8aIEn9RmPO3iWkV-UnqRAQF1pfUDq_li_bWl0c4LHFWlhjlu70Q==

GET
H2 200 MyDHL_Logo_73x38.png
cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/ 2 KB
2 KB 26ms
26ms Image
image/png 18.173.154.59
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/MyDHL_Logo_73x38.png

Requested by

Host: www.eservicebits.com
URL: https://www.eservicebits.com/landingpages/939c66c5-a2e6-4d48-93bb-6fda5e52ed17/IpwxRbVZ0aZc3yagopFTr-8tV6ehjo9UpAHEzMbVKhA

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.173.154.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-173-154-59.muc50.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

52aef0018a3fd9fc92f48bd3dd5cb9a69390ad34764ac653a249306d5dc9f694

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.eservicebits.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.38 Safari/537.36

Response headers

x-amz-version-id: CAP5EDjmEu1LK.9mikSXa75IqdjucNUn
date: Sat, 15 Jun 2024 09:33:35 GMT
via: 1.1 106a2e3801afa4dfd5bd4bfaeb93d526.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: MUC50-P3
age: 57984
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 1965
last-modified: Wed, 29 Mar 2023 03:32:55 GMT
server: AmazonS3
etag: "16ead6ec6ff36f3d4934f97f4bf5550b"
content-type: image/png
accept-ranges: bytes
x-amz-cf-id: A4n9vLf0j4rmxBkvraY271d1OBvN4lD1MtlrSgxT3o1MuBrpGL_STQ==

GET
H2 200 footer_logo.png
cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/ 6 KB
7 KB 37ms
36ms Image
image/png 18.173.154.59
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/footer_logo.png

Requested by

Host: www.eservicebits.com
URL: https://www.eservicebits.com/landingpages/939c66c5-a2e6-4d48-93bb-6fda5e52ed17/IpwxRbVZ0aZc3yagopFTr-8tV6ehjo9UpAHEzMbVKhA

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.173.154.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-173-154-59.muc50.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

baed8711f954b7a12fd77083f6bedaa1277f31e99b378ea6cda883474077355e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.eservicebits.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.38 Safari/537.36

Response headers

x-amz-version-id: zz8DZFkwIGeMWIAkhoL5wk2UCzPNDNbp
date: Sat, 15 Jun 2024 09:33:35 GMT
via: 1.1 106a2e3801afa4dfd5bd4bfaeb93d526.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: MUC50-P3
age: 57984
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 6506
last-modified: Wed, 29 Mar 2023 03:33:13 GMT
server: AmazonS3
etag: "fcb8d373abb6591008d8ae79fc4a2670"
content-type: image/png
accept-ranges: bytes
x-amz-cf-id: WYpykAW6xY7BwaRwDGo3mdumYP50jgZQzpBwBKcsUxgZf9yTLUgp2Q==

GET
H2 200 flags.32c.png
cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/ 103 KB
104 KB 51ms
50ms Image
image/png 18.173.154.59
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/flags.32c.png

Requested by

Host: www.eservicebits.com
URL: https://www.eservicebits.com/landingpages/939c66c5-a2e6-4d48-93bb-6fda5e52ed17/IpwxRbVZ0aZc3yagopFTr-8tV6ehjo9UpAHEzMbVKhA

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.173.154.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-173-154-59.muc50.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

71cd76e19df0aad70f2e9b57c162a03070836e1056ca8b3353511ee87b2ae08a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.eservicebits.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.38 Safari/537.36

Response headers

x-amz-version-id: qNXlYaTQqwSDxs0QipcYN4ptXq50b6l_
date: Sat, 15 Jun 2024 09:33:38 GMT
via: 1.1 106a2e3801afa4dfd5bd4bfaeb93d526.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: MUC50-P3
age: 57981
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 105697
last-modified: Wed, 29 Mar 2023 03:33:09 GMT
server: AmazonS3
etag: "d0c0bf939d36fb4658cc0da00980738e"
content-type: image/png
accept-ranges: bytes
x-amz-cf-id: FIMhzZwdWulOBVUv3scsp8M4DeU8dslaRBSNpIEMjJdFd06VfVr4LA==

GET
H2 200 dhl_as_background.jpg
cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/ 282 KB
283 KB 51ms
51ms Image
image/jpeg 18.173.154.59
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/dhl_as_background.jpg

Requested by

Host: www.eservicebits.com
URL: https://www.eservicebits.com/landingpages/939c66c5-a2e6-4d48-93bb-6fda5e52ed17/IpwxRbVZ0aZc3yagopFTr-8tV6ehjo9UpAHEzMbVKhA

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.173.154.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-173-154-59.muc50.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

32d32a167360f14effcc8e58028d9fda2e8ac0e1624078d6cc4c5a36a41f6386

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.eservicebits.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.38 Safari/537.36

Response headers

x-amz-version-id: dHKLAEjQ4e7MCmAmXqe0iHtGpJw7wYhM
date: Sat, 15 Jun 2024 09:33:38 GMT
via: 1.1 106a2e3801afa4dfd5bd4bfaeb93d526.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: MUC50-P3
age: 57981
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 288866
last-modified: Wed, 29 Mar 2023 03:33:00 GMT
server: AmazonS3
etag: "396a2d516b804a157965e712756007a1"
content-type: image/jpeg
accept-ranges: bytes
x-amz-cf-id: TUrB53CMEngD5-uC0KSlhgthSQM0fUbZ-Clv9oj7e0RNDrcJj8vwQQ==

GET dhl_icon.woff
cloud.phishinsight.trendmicro.com/content/lps/assets/system/fonts/ 0
0

GET dhl.woff
cloud.phishinsight.trendmicro.com/content/lps/assets/system/fonts/ 0
0

GET dhl_icon.ttf
cloud.phishinsight.trendmicro.com/content/lps/assets/system/fonts/ 0
0

GET dhl.ttf
cloud.phishinsight.trendmicro.com/content/lps/assets/system/fonts/ 0
0

GET
H2 403 favicon.ico
www.eservicebits.com/ 42 B
425 B 102ms
101ms Other
application/json 18.173.154.115
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.eservicebits.com/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.154.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-154-115.muc50.r.cloudfront.net
Software: /
Resource Hash: f249b63cb2fcb66b47e86f906c98f8fd912e82dd035b4e53d7e72fc1960cfd16

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.eservicebits.com/landingpages/939c66c5-a2e6-4d48-93bb-6fda5e52ed17/IpwxRbVZ0aZc3yagopFTr-8tV6ehjo9UpAHEzMbVKhA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.38 Safari/537.36

Response headers

date: Sun, 16 Jun 2024 01:39:59 GMT
x-amzn-errortype: MissingAuthenticationTokenException
via: 1.1 cb7ecd2473bf95a71af8d1ff8d1034fa.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P3
x-amzn-trace-id: Root=1-666e426f-5453cf8a773e47f10db11e15
x-amzn-requestid: 479945d2-9c2e-4cdb-8fdf-d20666401638
x-cache: Error from cloudfront
content-type: application/json
x-amz-apigw-id: Zb9RcFGWDoEEtgg=
content-length: 42
x-amz-cf-id: zYbHtuORMMV5HWduE-0F45vKLlSi3nM4ZE7C9MjySMHEVXmN7Z9tsw==

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cloud.phishinsight.trendmicro.com
URL: https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/fonts/dhl_icon.woff

Domain: cloud.phishinsight.trendmicro.com
URL: https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/fonts/dhl.woff

Domain: cloud.phishinsight.trendmicro.com
URL: https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/fonts/dhl_icon.ttf

Domain: cloud.phishinsight.trendmicro.com
URL: https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/fonts/dhl.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

11 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://www.eservicebits.com/landingpages/939c66c5-a2e6-4d48-93bb-6fda5e52ed17/IpwxRbVZ0aZc3yagopFTr-8tV6ehjo9UpAHEzMbVKhA(Line 5) Message: Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-BgPeq7vel58bLtyzXCck+TfouV1cx+BTgY8vFx3f+SQ='), or a nonce ('nonce-...') is required to enable inline execution.
recommendation	verbose	URL: https://www.eservicebits.com/landingpages/939c66c5-a2e6-4d48-93bb-6fda5e52ed17/IpwxRbVZ0aZc3yagopFTr-8tV6ehjo9UpAHEzMbVKhA Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
javascript	error	URL: https://www.eservicebits.com/landingpages/939c66c5-a2e6-4d48-93bb-6fda5e52ed17/IpwxRbVZ0aZc3yagopFTr-8tV6ehjo9UpAHEzMbVKhA Message: Access to font at 'https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/fonts/dhl_icon.woff' from origin 'https://www.eservicebits.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/fonts/dhl_icon.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.eservicebits.com/landingpages/939c66c5-a2e6-4d48-93bb-6fda5e52ed17/IpwxRbVZ0aZc3yagopFTr-8tV6ehjo9UpAHEzMbVKhA Message: Access to font at 'https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/fonts/dhl.woff' from origin 'https://www.eservicebits.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/fonts/dhl.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.eservicebits.com/landingpages/939c66c5-a2e6-4d48-93bb-6fda5e52ed17/IpwxRbVZ0aZc3yagopFTr-8tV6ehjo9UpAHEzMbVKhA Message: Access to font at 'https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/fonts/dhl_icon.ttf' from origin 'https://www.eservicebits.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/fonts/dhl_icon.ttf Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.eservicebits.com/landingpages/939c66c5-a2e6-4d48-93bb-6fda5e52ed17/IpwxRbVZ0aZc3yagopFTr-8tV6ehjo9UpAHEzMbVKhA Message: Access to font at 'https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/fonts/dhl.ttf' from origin 'https://www.eservicebits.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://cloud.phishinsight.trendmicro.com/content/lps/assets/system/fonts/dhl.ttf Message: Failed to load resource: net::ERR_FAILED
network	error	URL: https://www.eservicebits.com/favicon.ico Message: Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cloud.phishinsight.trendmicro.com
www.eservicebits.com
cloud.phishinsight.trendmicro.com
18.173.154.115
18.173.154.59
118751357eaa919071d159c4d1e2f2986d41202f78c8778f22ca65766817c939
30e04c10fe07ca5418298fe379bc7d26c4f597478d976a4c21cb0eabf61edb87
32d32a167360f14effcc8e58028d9fda2e8ac0e1624078d6cc4c5a36a41f6386
35b8eca53271516f3d66a3dd8f89e1366edb87adad26015424148de71dfcce46
52aef0018a3fd9fc92f48bd3dd5cb9a69390ad34764ac653a249306d5dc9f694
71cd76e19df0aad70f2e9b57c162a03070836e1056ca8b3353511ee87b2ae08a
98f0d6326d2bbc3910ca8a33a97320be5830b5953d98a11d0aa302e4955c77ee
b58565c38476d68a546119d65a2c1c3f8b4950ec1516e0bb57f3421eca576d65
baed8711f954b7a12fd77083f6bedaa1277f31e99b378ea6cda883474077355e
bec410bdccc6b1342258f0aa17fb3ddf86a362141a485a44a85b4da078804201
f249b63cb2fcb66b47e86f906c98f8fd912e82dd035b4e53d7e72fc1960cfd16

www.eservicebits.com Open in urlscan Pro 18.173.154.115 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

15 Requests

73 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

1 Countries

1081 kBTransfer

1234 kBSize

0 Cookies

0 Outgoing links

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

11 Console Messages

Indicators

www.eservicebits.com Open in urlscan Pro
18.173.154.115 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

73 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

1081 kB
Transfer

1234 kB
Size

0
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!