www.regionssupport.info
Open in
urlscan Pro
68.178.247.189
Malicious Activity!
Public Scan
Submitted URL: https://www.regionssupport.info/
Effective URL: https://www.regionssupport.info/AccountUpdate/login/index.php?actionType=AcctLogin&LoginSession=True&SessionId=c9e835f7763062d52...
Submission: On December 05 via automatic, source certstream-suspicious — Scanned from DE
Effective URL: https://www.regionssupport.info/AccountUpdate/login/index.php?actionType=AcctLogin&LoginSession=True&SessionId=c9e835f7763062d52...
Submission: On December 05 via automatic, source certstream-suspicious — Scanned from DE
Summary
This website contacted 3 IPs
in 2 countries
across 3 domains to perform 23 HTTP transactions.
The main IP is 68.178.247.189, located in
United States and
belongs to GO-DADDY-COM-LLC, US.
The main domain is www.regionssupport.info.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on December 5th 2021. Valid for: a year.
This is the only time www.regionssupport.info was scanned on urlscan.io!
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on December 5th 2021. Valid for: a year.
This is the only time www.regionssupport.info was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Regions Bank (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 18 | 68.178.247.189 68.178.247.189 | 398101 (GO-DADDY-...) (GO-DADDY-COM-LLC) | |
| 2 | 2606:4700::68... 2606:4700::6810:5714 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 4 | 18.195.42.228 18.195.42.228 | 16509 (AMAZON-02) (AMAZON-02) | |
| 23 | 3 |
18
68.178.247.189
(United States)
ASN398101 (GO-DADDY-COM-LLC, US)
PTR: ip-68-178-247-189.ip.secureserver.net
ASN398101 (GO-DADDY-COM-LLC, US)
PTR: ip-68-178-247-189.ip.secureserver.net
| www.regionssupport.info |
4
18.195.42.228
(Frankfurt am Main, Germany)
ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
| nexus.ensighten.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 18 |
regionssupport.info
1 redirects
www.regionssupport.info |
2 MB |
| 4 |
ensighten.com
nexus.ensighten.com |
4 KB |
| 2 |
jsdelivr.net
cdn.jsdelivr.net |
46 KB |
| 23 | 3 |
| Domain | Requested by | |
|---|---|---|
| 18 | www.regionssupport.info |
1 redirects
www.regionssupport.info
|
| 4 | nexus.ensighten.com |
www.regionssupport.info
|
| 2 | cdn.jsdelivr.net |
www.regionssupport.info
|
| 23 | 3 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.regions.com |
| survey.regions.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| regionssupport.info Go Daddy Secure Certificate Authority - G2 |
2021-12-05 - 2023-01-06 |
a year | crt.sh |
| sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-07-03 - 2022-07-02 |
a year | crt.sh |
| nexus.ensighten.com DigiCert TLS RSA SHA256 2020 CA1 |
2021-09-14 - 2022-10-12 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.regionssupport.info/AccountUpdate/login/index.php?actionType=AcctLogin&LoginSession=True&SessionId=c9e835f7763062d527418320ec9e04a3&__ENVAR=
Frame ID: 38E9B05E4870024DA0FBFA78BD35E2AF
Requests: 23 HTTP requests in this frame
Screenshot
Page Title
Regions Online Banking - Log in to your accounts | RegionsPage URL History Show full URLs
-
https://www.regionssupport.info/
HTTP 302
https://www.regionssupport.info/AccountUpdate/login/index.php?actionType=AcctLogin&LoginSession=True&Session... Page URL
Page Statistics
9 Outgoing links
These are links going to different origins than the main page.
URL: https://www.regions.com/about-regions/privacy-security/online-privacy-notice#cookie-use
Title: Learn more about how Regions uses cookies.
Title: Learn more about how Regions uses cookies.
Search URL Search Domain Scan URL
URL: https://www.regions.com/personal-banking
Search URL Search Domain Scan URL
URL: https://www.regions.com/help
Title: Contact Us
Title: Contact Us
Search URL Search Domain Scan URL
URL: https://www.regions.com/digital-banking/electronic-banking-service-agreement
Title: Terms and Conditions
Title: Terms and Conditions
Search URL Search Domain Scan URL
URL: https://www.regions.com/about-regions/privacy-security/privacy-pledge
Title: Privacy Pledge
Title: Privacy Pledge
Search URL Search Domain Scan URL
URL: https://www.regions.com/about-regions/privacy-security
Title: Security
Title: Security
Search URL Search Domain Scan URL
URL: https://www.regions.com/about-regions/privacy-security/online-privacy-notice#ads
Title: Online Tracking and Advertising
Title: Online Tracking and Advertising
Search URL Search Domain Scan URL
URL: https://www.regions.com/about-regions/Accessible-Banking
Title: Accessible Banking
Title: Accessible Banking
Search URL Search Domain Scan URL
URL: https://survey.regions.com/jfe/form/SV_0Jm6o1kcV7mAmA5?source=olblogin
Title: Leave Feedback
Title: Leave Feedback
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://www.regionssupport.info/
HTTP 302
https://www.regionssupport.info/AccountUpdate/login/index.php?actionType=AcctLogin&LoginSession=True&SessionId=c9e835f7763062d527418320ec9e04a3&__ENVAR= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
23 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
index.php
www.regionssupport.info/AccountUpdate/login/ Redirect Chain
|
8 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
6ecf86ad9b4511b37d16156ceb162c34.js.download
www.regionssupport.info/AccountUpdate/login/Regions%20Online%20Banking%20-%20Log%20in%20to%20your%20accounts%20_%20Regions_files/ |
7 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
serverComponent.php
www.regionssupport.info/AccountUpdate/login/Regions%20Online%20Banking%20-%20Log%20in%20to%20your%20accounts%20_%20Regions_files/ |
282 B 252 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
com-regions.css
www.regionssupport.info/AccountUpdate/login/Regions%20Online%20Banking%20-%20Log%20in%20to%20your%20accounts%20_%20Regions_files/ |
369 KB 43 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
olbAuth.min.css
www.regionssupport.info/AccountUpdate/login/Regions%20Online%20Banking%20-%20Log%20in%20to%20your%20accounts%20_%20Regions_files/ |
2 KB 988 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.0.0-beta1/dist/css/ |
150 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@5.0.0-beta1/dist/js/ |
79 KB 22 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
regions-logo-no-r.svg
www.regionssupport.info/AccountUpdate/login/Regions%20Online%20Banking%20-%20Log%20in%20to%20your%20accounts%20_%20Regions_files/ |
5 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
xmui.css
www.regionssupport.info/AccountUpdate/login/Regions%20Online%20Banking%20-%20Log%20in%20to%20your%20accounts%20_%20Regions_files/ |
798 KB 345 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
xmui-no-vars.css
www.regionssupport.info/AccountUpdate/login/Regions%20Online%20Banking%20-%20Log%20in%20to%20your%20accounts%20_%20Regions_files/ |
764 KB 341 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Common.css
www.regionssupport.info/AccountUpdate/login/Regions%20Online%20Banking%20-%20Log%20in%20to%20your%20accounts%20_%20Regions_files/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
login.min.js.download
www.regionssupport.info/AccountUpdate/login/Regions%20Online%20Banking%20-%20Log%20in%20to%20your%20accounts%20_%20Regions_files/ |
1 MB 263 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
equal-housing-lender.svg
www.regionssupport.info/AccountUpdate/login/Regions%20Online%20Banking%20-%20Log%20in%20to%20your%20accounts%20_%20Regions_files/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
member-fdic.svg
www.regionssupport.info/AccountUpdate/login/Regions%20Online%20Banking%20-%20Log%20in%20to%20your%20accounts%20_%20Regions_files/ |
6 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
regionslib.min.js(1).download
www.regionssupport.info/AccountUpdate/login/Regions%20Online%20Banking%20-%20Log%20in%20to%20your%20accounts%20_%20Regions_files/ |
994 KB 995 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Bootstrap.js.download
www.regionssupport.info/AccountUpdate/login/Regions%20Online%20Banking%20-%20Log%20in%20to%20your%20accounts%20_%20Regions_files/ |
355 KB 76 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
source-sans-pro-regular-webfont.woff
www.regionssupport.info/AccountUpdate/login/Regions%20Online%20Banking%20-%20Log%20in%20to%20your%20accounts%20_%20Regions_files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
1.gif
nexus.ensighten.com/privacy/v1/b/ |
0 107 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
serverComponent.php
nexus.ensighten.com/regions/transmit-prod/ |
282 B 424 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
f7431caa1ca81557178898866a70818a.js
nexus.ensighten.com/regions/transmit-prod/code/ |
10 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
e.gif
nexus.ensighten.com/error/ |
0 106 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
source-sans-pro-600-webfont.woff
www.regionssupport.info/AccountUpdate/login/Regions%20Online%20Banking%20-%20Log%20in%20to%20your%20accounts%20_%20Regions_files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
source-sans-pro-700-webfont.woff
www.regionssupport.info/AccountUpdate/login/Regions%20Online%20Banking%20-%20Log%20in%20to%20your%20accounts%20_%20Regions_files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
&lnn=-1&fn=&cid=1202&client=regions&publishPath=transmit-prod&rid=-1&did=-1&errorName=TypeError){kind=link}
&lnn=-1&fn=&cid=1202&client=regions&publishPath=transmit-prod&rid=-1&did=-1&errorName=TypeError){kind=link}
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Regions Bank (Banking)125 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler number| uidEvent object| bootstrap function| progressBarForm function| passwordAuthenticator function| getQuestions function| pwdChange function| challengeQuestionAuth function| lockedOptions function| secQuestionOptions function| _instanceof function| _typeof function| _classCallCheck function| _defineProperties function| _createClass function| _inherits function| _setPrototypeOf function| _createSuper function| _possibleConstructorReturn function| _assertThisInitialized function| _isNativeReflectConstruct function| _getPrototypeOf function| debugOut function| clearUIContainer function| displayPagelevelError function| clearPagelevelError function| clearCustomValidationError function| addCustomValidationError function| handleGetQuestionKeyEvents function| handleChangePasswordKeyEvents function| handleChallengeQuestionKeyEvents function| handlePasswordKeyEvents function| validateCurrentPassword function| validateNewPassword function| validateConfirmPassword function| validateChallengeAnswer function| validateQuestion1 function| validateQuestion2 function| validateQuestion3 function| validateAnswer1 function| validateAnswer2 function| validateAnswer3 function| validateVerifyAnswer1 function| validateVerifyAnswer2 function| validateVerifyAnswer3 function| onSecurityQuestionChange function| AlignCenter function| sessionMonitor function| AddAriaHidden function| RemoveAriaHidden function| StopSessionTimer function| InitiateLoginJourney function| getRelyingParty function| RememberMe function| GetConfiguration function| ValidateOnlineID function| ErrorLogger function| PageLevelInfo function| RedirectToLoginPage string| demoOptionTagList undefined| _expirationTimeoutID undefined| _warningTimeoutID string| authFailed string| invalidPassword string| invalidCurrentPassword object| passwordPattern string| errorBlockCNP string| errorBlockNP string| emptyErrorBlockCNP string| emptyErrorBlockNP string| emptyErrorBlockCUP string| errorBlockConfirmPassword string| errorSameNewPassword string| maxCharacterPassword object| answerPattern string| notSelectedQuestionErrMSG string| duplicateQuestionSelectedErrMSG string| errorBlockDDL string| errorEmptySecurityAnswer string| errorA1Unique string| errorA2Unique string| errorA3Unique string| errorBlock string| errorEmptyVerifyAnswer string| pageLevelError string| patternError string| errorEmptyChallengeAnswer string| tryAgain string| notSelected boolean| pageLevelMessageDisplayed function| RegUIHandler function| PasswordAuthenticatorSession function| FormSession object| tsConfigSetting string| accountOverViewURL undefined| tsLevel string| verifyIdentityURL string| systemUnavailableURL string| genericErrorURL function| $ function| jQuery object| xmsdk object| com object| aesjs object| elliptic function| sha256 function| sha224 object| base64js object| __XMSDK_PLUGINS object| xmui boolean| cookiesDisabled function| _toConsumableArray function| _typeof2 object| validator object| RDS function| zxcvbn object| ensBootstraps object| Bootstrapper object| ensClientConfig object| ensLogger boolean| ensBrowserSupported object| gateway2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| www.regionssupport.info/ | Name: PHPSESSID Value: 05f07eebe04cc88969f294fa5b19c4f5 |
|
| www.regionssupport.info/ | Name: TestCookie Value: testcookie |
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
nexus.ensighten.com
www.regionssupport.info
18.195.42.228
2606:4700::6810:5714
68.178.247.189
0267260045096457f26914277f49eef5da5ec54ac6aee8579be4810332e518b6
176d4569e4483527c06f7f248f0099a1d9e7f8763a68c15c1744cc2a737c50a8
1ed5153894d62b5899a70d0697cc3e7133312b24ee1c28dd26896a6016ecb813
31bc0d76620dabf00a7873643c4bf89cb51a6ef176d6ff68ea38463a1ad2f5d4
3be3373680ff685f39a6d078e0f82e5d417316dd5d37bdebbd9c55135983462b
4337eec4ae7e137340767affcb6356853b65954d881d784aa3f119f195164e57
452fbf76ed27ebd10a4bf8995939b51c67da43e4c039b4f0091ad585383e9336
4a270d9251352ad9754048eda6681b85464fd24a6b78ed809a069a830497cba6
71d89feac24a5e17ba2748b0a87787d3b6ba4613ab2476a2107beb52a25a00e1
8769789308d298586ca2c37d62179466c3c7084febdf177d37c3e38d8f2493db
886a0d1005f4d663e11473c81ea20b2b9d618372313df55223d2c571dffc5698
8b69a3707a2ef4a748dd6c9923a1fa17d1ed5d32eee6e60240540217cf30b324
912f72af9fe61099bc2452960df7b72ee662d5c3e6188ab246767de1fe367913
9d782980884a0c3a5631f5534c0a957d08d714097a24de9b7fed6b108406d75c
c7c7b774b9f2c64c84544b920465ce2514ce5b14c4312c6dc336b2732a33208f
dbbff1d268355ba09966710bfbe0226aa56c48e5c327d8bd8be0e3599f5c2c7e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4bc94279e093f25720c2867e7a08dbfaaa140636f11eab5ac4e204a93a3751e
e5ec6358137e0bfd2e0fa87ec48b58f57d5b3ff8cff500d0f8ea0a3f77f17995