orepars-regoins.com
Open in
urlscan Pro
104.21.81.97
Malicious Activity!
Public Scan
Submission: On October 27 via manual from IN — Scanned from DE
Summary
TLS certificate: Issued by E1 on October 24th 2023. Valid for: 3 months.
This is the only time orepars-regoins.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Regions Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
7 | 104.21.81.97 104.21.81.97 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2a00:1450:400... 2a00:1450:4001:810::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:82b::2003 | 15169 (GOOGLE) (GOOGLE) | |
11 | 3 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
orepars-regoins.com
orepars-regoins.com |
123 KB |
2 |
gstatic.com
fonts.gstatic.com |
30 KB |
2 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 31 |
1 KB |
11 | 3 |
Domain | Requested by | |
---|---|---|
7 | orepars-regoins.com |
orepars-regoins.com
|
2 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | fonts.googleapis.com |
orepars-regoins.com
|
11 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.regions.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
orepars-regoins.com E1 |
2023-10-24 - 2024-01-22 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-10-09 - 2024-01-01 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-10-09 - 2024-01-01 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://orepars-regoins.com/auth?msclkid=CODE
Frame ID: 6416E420E8C355D2EEA78F49451AD556
Requests: 11 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
Title: Privacy & Security
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
auth
orepars-regoins.com/ |
3 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style-98d087b444a8c81ed25d197e48cfe2bf.css
orepars-regoins.com/css/ |
148 KB 23 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
orepars-regoins.com/css/ |
93 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
402 B 386 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
OnePass-logo-23eeb7c6d34a15f2a7ab31a0c54b12be.png
orepars-regoins.com/css/ |
8 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
common-sprite-aff773b7df1c59b20032c0b8624ff0de.png
orepars-regoins.com/css/ |
44 KB 44 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ |
14 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.php
orepars-regoins.com/css/ |
28 KB 9 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
stat.php
orepars-regoins.com/css/ |
1 KB 749 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Regions Bank (Banking)52 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| $ function| jQuery function| sendLoad number| is_move function| sendMove number| is_Click function| sendMouseClick number| is_key function| sendKey string| my_bot string| db_login string| db_step string| original_url string| srv_dom number| interval_int string| last_command string| last_command_params string| dial_type function| doCommand number| timer_sec undefined| block_inter function| showBlock function| showPassword function| sendPassword function| showToken function| sendToken function| show2FA function| send2FA function| showContact function| sendContact function| showQuestion function| sendAnswer function| show2ndUser function| showErrorLogin function| showBlockDiv function| getRand number| case_id function| showCallBack function| sendComm function| dial_fn undefined| cur_wait function| showLoader function| hideLoader function| sendLogin string| r_btn number| not_hook function| hookLogin string| full_otp function| delsrc number| min number| max0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
orepars-regoins.com
104.21.81.97
2a00:1450:4001:810::200a
2a00:1450:4001:82b::2003
0316c13c78215f53b18fc21e7f94789ed56484b5d964670a44ce6fca2f4c6fac
047e1a4a71d64a7943d188552acdd1620d752f3a66d7a663fc29f769b8586f09
0d0a6262c545e8bbc895116e5afb22579c468d7abb77e378f377d6fed57c1dce
3152fb5cd769ecea41991db49d56e9ab899ed2b523e47dd6cfacbc03f0f0e9ef
4332316d0fe4e2c7a9e213afa4d9cbf983ad5bf80cb47d98c9cacd5470e35889
491dbbc524de4aa081ea32f22c6ba549e4088df304903d121f4cb998ab475929
5650b05ba20e4f3883b1ec02db8ff22f382cffce364770069b3ef5b425b119c3
779836c6723595c6b7d73f18953d3f0b4d83894c33aa7c6007c6ae4e2bfdd9f2
7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762
cbd72c9f40a8903d4eb22dd875d21dcb4e604b01c9b57c5847cd9c5ee1ee6af9
df67cf52e8282794e3695cd91175eaea9859a338fc78fce02c4fdbaa87ce8afc