americafirst0nline-verifyit.lemonwedge.co
Open in
urlscan Pro
69.49.246.103
Malicious Activity!
Public Scan
URL:
https://americafirst0nline-verifyit.lemonwedge.co/login.php?online_id=313856bb91011d7bc82e60c1d&
Submission: On April 22 via automatic, source openphish — Scanned from DE
Submission: On April 22 via automatic, source openphish — Scanned from DE
Summary
This website contacted 4 IPs
in 2 countries
across 3 domains to perform 22 HTTP transactions.
The main IP is 69.49.246.103, located in
United States and
belongs to UNIFIEDLAYER-AS-1, US.
The main domain is americafirst0nline-verifyit.lemonwedge.co.
TLS certificate: Issued by R3 on April 18th 2022. Valid for: 3 months.
This is the only time americafirst0nline-verifyit.lemonwedge.co was scanned on urlscan.io!
TLS certificate: Issued by R3 on April 18th 2022. Valid for: 3 months.
This is the only time americafirst0nline-verifyit.lemonwedge.co was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Regions Bank (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 7 | 69.49.246.103 69.49.246.103 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
| 4 | 205.255.100.240 205.255.100.240 | 10801 (REGIONS-A...) (REGIONS-ASN-1) | |
| 6 | 18.197.253.20 18.197.253.20 | 16509 (AMAZON-02) (AMAZON-02) | |
| 22 | 4 |
7
69.49.246.103
(United States)
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 69-49-246-103.unifiedlayer.com
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 69-49-246-103.unifiedlayer.com
| americafirst0nline-verifyit.lemonwedge.co |
6
18.197.253.20
(Frankfurt am Main, Germany)
ASN16509 (AMAZON-02, US)
PTR: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
ASN16509 (AMAZON-02, US)
PTR: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
| nexus.ensighten.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
lemonwedge.co
americafirst0nline-verifyit.lemonwedge.co |
12 KB |
| 6 |
ensighten.com
nexus.ensighten.com — Cisco Umbrella Rank: 2772 |
81 KB |
| 4 |
regions.com
login.regions.com — Cisco Umbrella Rank: 139565 |
545 KB |
| 22 | 3 |
| Domain | Requested by | |
|---|---|---|
| 7 | americafirst0nline-verifyit.lemonwedge.co |
americafirst0nline-verifyit.lemonwedge.co
|
| 6 | nexus.ensighten.com |
americafirst0nline-verifyit.lemonwedge.co
nexus.ensighten.com |
| 4 | login.regions.com |
americafirst0nline-verifyit.lemonwedge.co
login.regions.com nexus.ensighten.com |
| 22 | 3 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.regions.com |
| onlinebanking.regions.com |
| survey.regions.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| cpcontacts.bylindsie.com R3 |
2022-04-18 - 2022-07-17 |
3 months | crt.sh |
| login.regions.com Sectigo RSA Extended Validation Secure Server CA |
2022-02-15 - 2023-02-15 |
a year | crt.sh |
| nexus.ensighten.com DigiCert TLS RSA SHA256 2020 CA1 |
2021-09-14 - 2022-10-12 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://americafirst0nline-verifyit.lemonwedge.co/login.php?online_id=313856bb91011d7bc82e60c1d&
Frame ID: FAF75A1F3406FB8DC113C852734730C4
Requests: 22 HTTP requests in this frame
Screenshot
Page Title
Regions Online Banking - Log in to your accounts | RegionsDetected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.php(?:$|\?)
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Ensighten
(Tag Managers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- //nexus\.ensighten\.com/
Page Statistics
12 Outgoing links
These are links going to different origins than the main page.
URL: https://www.regions.com/about-regions/privacy-security/online-privacy-notice#cookie-use
Title: Learn more about how Regions uses cookies.
Title: Learn more about how Regions uses cookies.
Search URL Search Domain Scan URL
URL: https://www.regions.com/personal-banking
Search URL Search Domain Scan URL
URL: https://onlinebanking.regions.com/customerservice/Recoveruserid
Title: Online ID
Title: Online ID
Search URL Search Domain Scan URL
URL: https://onlinebanking.regions.com/customerservice/forgottenpassword
Title: Password?
Title: Password?
Search URL Search Domain Scan URL
URL: https://onlinebanking.regions.com/enrollment/home
Title: Enroll
Title: Enroll
Search URL Search Domain Scan URL
URL: https://www.regions.com/help
Title: Contact Us
Title: Contact Us
Search URL Search Domain Scan URL
URL: https://www.regions.com/digital-banking/electronic-banking-service-agreement
Title: Terms and Conditions
Title: Terms and Conditions
Search URL Search Domain Scan URL
URL: https://www.regions.com/about-regions/privacy-security/privacy-pledge
Title: Privacy Pledge
Title: Privacy Pledge
Search URL Search Domain Scan URL
URL: https://www.regions.com/about-regions/privacy-security
Title: Security
Title: Security
Search URL Search Domain Scan URL
URL: https://www.regions.com/about-regions/privacy-security/online-privacy-notice#ads
Title: Online Tracking and Advertising
Title: Online Tracking and Advertising
Search URL Search Domain Scan URL
URL: https://www.regions.com/about-regions/Accessible-Banking
Title: Accessible Banking
Title: Accessible Banking
Search URL Search Domain Scan URL
URL: https://survey.regions.com/jfe/form/SV_0Jm6o1kcV7mAmA5?source=olblogin
Title: Leave Feedback
Title: Leave Feedback
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
22 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
login.php
americafirst0nline-verifyit.lemonwedge.co/ |
12 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
com-regions.css
login.regions.com/Assets/Styles/Library/RegionsBootstrap/ |
369 KB 51 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
olbAuth.min.css
login.regions.com/Assets/Styles/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
regions-logo-no-r.svg
login.regions.com/Assets/Images/ |
5 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
xmui.css
americafirst0nline-verifyit.lemonwedge.co/Assets/Styles/Library/Transmit/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
xmui-no-vars.css
americafirst0nline-verifyit.lemonwedge.co/Assets/Styles/Library/Transmit/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Common.css
americafirst0nline-verifyit.lemonwedge.co/Assets/Styles/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login.min.js
americafirst0nline-verifyit.lemonwedge.co/Assets/Scripts/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
equal-housing-lender.svg
americafirst0nline-verifyit.lemonwedge.co/Assets/Images/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
member-fdic.svg
americafirst0nline-verifyit.lemonwedge.co/Assets/Images/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
regionslib.min.js
login.regions.com/Assets/Scripts/ |
994 KB 490 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Bootstrap.js
nexus.ensighten.com/regions/transmit-prod/ |
355 KB 77 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
source-sans-pro-regular-webfont.woff
login.regions.com/Assets/Styles/Library/RegionsBootstrap/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
source-sans-pro-700-webfont.woff
login.regions.com/Assets/Styles/Library/RegionsBootstrap/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
1.gif
nexus.ensighten.com/privacy/v1/b/ |
0 106 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
com-regions.css
login.regions.com/Assets/Styles/Library/RegionsBootstrap/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
olbAuth.min.css
login.regions.com/Assets/Styles/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
serverComponent.php
nexus.ensighten.com/regions/transmit-prod/ |
282 B 424 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
58d5327b63e00f1c85018253fedac26c.js
nexus.ensighten.com/regions/transmit-prod/code/ |
10 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
e.gif
nexus.ensighten.com/error/ |
0 106 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
source-sans-pro-600-webfont.woff
login.regions.com/Assets/Styles/Library/RegionsBootstrap/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
1.gif
nexus.ensighten.com/privacy/v1/b/ |
0 106 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
&lnn=-1&fn=&cid=1202&client=regions&publishPath=transmit-prod&rid=-1&did=-1&errorName=TypeError){kind=link}
&lnn=-1&fn=&cid=1202&client=regions&publishPath=transmit-prod&rid=-1&did=-1&errorName=TypeError){kind=link}
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- login.regions.com
- URL
- https://login.regions.com/Assets/Styles/Library/RegionsBootstrap/fonts/source-sans-pro-regular-webfont.woff
- Domain
- login.regions.com
- URL
- https://login.regions.com/Assets/Styles/Library/RegionsBootstrap/fonts/source-sans-pro-700-webfont.woff
- Domain
- login.regions.com
- URL
- https://login.regions.com/Assets/Styles/Library/RegionsBootstrap/com-regions.css?v=x8e3dLnyxkyEVEuSBGXOJRTOWxTEMSxtwzaycyozII8
- Domain
- login.regions.com
- URL
- https://login.regions.com/Assets/Styles/olbAuth.min.css
- Domain
- login.regions.com
- URL
- https://login.regions.com/Assets/Styles/Library/RegionsBootstrap/fonts/source-sans-pro-600-webfont.woff
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Regions Bank (Banking)21 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails boolean| cookiesDisabled function| _classCallCheck function| _toConsumableArray function| _typeof2 function| _typeof function| _createClass function| $ function| jQuery object| validator object| RDS function| zxcvbn object| ensBootstraps object| Bootstrapper object| ensClientConfig object| ensLogger boolean| ensBrowserSupported object| gateway1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| americafirst0nline-verifyit.lemonwedge.co/ | Name: TestCookie Value: testcookie |
16 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
americafirst0nline-verifyit.lemonwedge.co
login.regions.com
nexus.ensighten.com
login.regions.com
18.197.253.20
205.255.100.240
69.49.246.103
1ed5153894d62b5899a70d0697cc3e7133312b24ee1c28dd26896a6016ecb813
234391e3ecaa96daeb8e4d13348a9cc3b768bba971574125a0dc35cf035ca990
2bf27bad165ae24751c1f8443c70593173268552ff1b05d7f904275ecccfaf22
7bdba31d3fbbbf798fe97e52b7e5d296c2aec91e527e1a6a68ed7f0b53bc644f
7c60e9115caafe4f38d41e3ea064cd4941f1389514910c0b6f4f0607f51cdcb1
912f72af9fe61099bc2452960df7b72ee662d5c3e6188ab246767de1fe367913
9d782980884a0c3a5631f5534c0a957d08d714097a24de9b7fed6b108406d75c
b41e794bd6c6a3489197911f0a9071c5f1cb3527c91c6abacc4fdf3f00cccf3a
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855