onsitehealthandsafety.origin.one
Category: Phishing
To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.
Description of onsitehealthandsafety.origin.one
The subdomain onsitehealthandsafety.origin.one appears to host a login portal branded "On-Site Health & Safety." Based on the page title, logo, and minimal interface shown in the screenshot, it may be intended as an employee, customer, or partner access page for a workplace health and safety service or internal account system.
The site does not present broader company information, public navigation, or explanatory content on the scanned page. Instead, it shows a simple email-and-password sign-in form with password recovery and help links, which suggests a restricted-access web application rather than a public informational website. The domain is part of the broader origin.one namespace, but the specific operator and business relationship are not fully clear from the visible page alone.
Safety Assessment for onsitehealthandsafety.origin.one
This scan found notable risk indicators. The domain was flagged by 10 out of 91 security engines, with multiple detections describing the page as phishing-related. That level of multi-engine agreement is a meaningful warning sign, especially because the visible content is a standalone credential-entry form with very limited surrounding context. Login-only pages on subdomains can be legitimate, but they are also commonly used in credential-harvesting campaigns when they lack clear organizational verification.
At the same time, some supporting checks were clean at the time of this scan: the malware scan did not identify malicious files, and the domain was not listed by the checked content-malice and threat-database sources. However, a clean file scan does not rule out phishing, since phishing pages often rely on ordinary web code and simple forms rather than malware payloads.
The domain itself is several years old, which can sometimes support legitimacy, but age alone does not outweigh the phishing detections and the sparse login-page presentation. Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site uses a valid SSL/TLS certificate issued through Amazon infrastructure, with hosting delivered via AWS CloudFront and an Amazon S3-backed web server. The resolved IP address is 13.249.228.112, and the nameservers are hosted on Amazon DNS. This setup is common for modern web applications and content delivery, but it does not by itself confirm legitimacy.
DNSSEC appears to be unsigned, which is not unusual but means DNS responses do not benefit from that additional integrity layer. No malicious files, flagged external links, or iframes were identified in the provided scan data, yet the page’s minimal credential form and the multi-engine phishing detections remain the primary technical concern at the time of this scan.
Share your experience with this website. Was it safe? Did you encounter any issues?