URL: https://luigimarch.com/regions/credit_verify.php
Submission: On October 11 via automatic, source openphish — Scanned from DE

Summary

This website contacted 6 IPs in 5 countries across 6 domains to perform 29 HTTP transactions. The main IP is 105.174.43.226, located in Angola and belongs to unitel-AS, AO. The main domain is luigimarch.com.
TLS certificate: Issued by R3 on September 24th 2022. Valid for: 3 months.
This is the only time luigimarch.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 105.174.43.226 37119 (unitel-AS)
1 2a00:1450:400... 15169 (GOOGLE)
1 15.188.95.229 16509 (AMAZON-02)
1 108.157.4.88 16509 (AMAZON-02)
2 104.17.209.240 13335 (CLOUDFLAR...)
29 6
Apex Domain
Subdomains
Transfer
2 qualtrics.com
siteintercept.qualtrics.com — Cisco Umbrella Rank: 1486
znebdjzidehxpwsol-regions.siteintercept.qualtrics.com Failed
8 KB
1 ensighten.com
nexus.ensighten.com — Cisco Umbrella Rank: 3863 Failed
701 B
1 regions.com
smetrics.regions.com — Cisco Umbrella Rank: 109313
onlinebanking.regions.com Failed
tm.regions.com Failed
4 KB
1 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 94
20 KB
1 luigimarch.com
luigimarch.com
38 KB
0 googletagmanager.com Failed
www.googletagmanager.com Failed
29 6
Domain Requested by
2 siteintercept.qualtrics.com luigimarch.com
1 nexus.ensighten.com luigimarch.com
1 smetrics.regions.com luigimarch.com
1 www.google-analytics.com luigimarch.com
1 luigimarch.com luigimarch.com
0 znebdjzidehxpwsol-regions.siteintercept.qualtrics.com Failed luigimarch.com
0 tm.regions.com Failed luigimarch.com
0 onlinebanking.regions.com Failed luigimarch.com
0 www.googletagmanager.com Failed luigimarch.com
29 9

This site contains no links.

Subject Issuer Validity Valid
*.luigimarch.com
R3
2022-09-24 -
2022-12-23
3 months crt.sh
*.google-analytics.com
GTS CA 1C3
2022-09-12 -
2022-12-05
3 months crt.sh
smetrics.regions.com
DigiCert TLS RSA SHA256 2020 CA1
2022-06-10 -
2023-07-11
a year crt.sh
nexus.ensighten.com
DigiCert TLS RSA SHA256 2020 CA1
2022-10-07 -
2023-10-14
a year crt.sh
*.qualtrics.com
DigiCert TLS RSA SHA256 2020 CA1
2022-05-04 -
2023-05-04
a year crt.sh

This page contains 1 frames:

Primary Page: https://luigimarch.com/regions/credit_verify.php
Frame ID: 02F93BA541522BA42063EE043A198BB6
Requests: 29 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • //nexus\.ensighten\.com/

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Page Statistics

29
Requests

21 %
HTTPS

20 %
IPv6

6
Domains

9
Subdomains

6
IPs

5
Countries

70 kB
Transfer

118 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

29 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request credit_verify.php
luigimarch.com/regions/
38 KB
38 KB
Document
General
Full URL
https://luigimarch.com/regions/credit_verify.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
105.174.43.226 , Angola, ASN37119 (unitel-AS, AO),
Reverse DNS
servidor.egatecloud.ao
Software
Apache /
Resource Hash
3db143c3f8e67481d27e16e136a96a8c4c0df9ce759c622b08a3608d02c1e677

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Tue, 11 Oct 2022 15:26:14 GMT
Keep-Alive
timeout=5, max=100
Server
Apache
Transfer-Encoding
chunked
analytics.js
www.google-analytics.com/
49 KB
20 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: luigimarch.com
URL: https://luigimarch.com/regions/credit_verify.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://luigimarch.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 11 Oct 2022 13:01:59 GMT
last-modified
Tue, 27 Sep 2022 22:01:05 GMT
server
Golfe2
age
5418
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20039
expires
Tue, 11 Oct 2022 15:01:59 GMT
s05863887553074
smetrics.regions.com/b/ss/regionsbankprod/10/JS-2.20.0/
4 KB
4 KB
Script
General
Full URL
https://smetrics.regions.com/b/ss/regionsbankprod/10/JS-2.20.0/s05863887553074?AQB=1&ndh=1&pf=1&callback=s_c_il[0].doPostbacks&et=1&t=5%2F1%2F2021%2010%3A13%3A38%205%20480&d.&nsid=0&jsonv=1&.d&mid=82133347415663284794423271278987424596&aamlh=6&ce=UTF-8&ns=regions&cdp=2&pageName=olb%7Ccustomerservice%7Cforgottenpassword&g=https%3A%2F%2Fonlinebanking.regions.com%2Fcustomerservice%2Fforgottenpassword&r=https%3A%2F%2Flogin.regions.com%2F&cc=USD&ch=customerservice&server=onlinebanking.regions.com&events=event1&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c1=D%3Dv1&v1=olb&h1=D%3Dv1&c2=D%3Dv2&v2=forgottenpassword&h2=D%3Dch&c3=D%3DpageName&v3=D%3DpageName&h3=forgottenpassword&c4=D%3Dg&v4=D%3Dg&c6=D%3Dv6&v6=en&c7=D%3Dv7&v7=tablet%20layout%7C996x640&c8=D%3Dv8&v8=olb%7Ccustomerservice%7Cforgottenpassword&c9=D%3Dv9&v9=71%7C71&v10=https%3A%2F%2Fonlinebanking.regions.com%2Fcustomerservice%2Fforgottenpassword&v12=D%3Dmid&v15=Repeat&v16=Less%20than%201%20day&v17=year%3D2021%20%7C%20month%3DFebruary%20%7C%20date%3D5%20%7C%20day%3DFriday%20%7C%20time%3D12%3A13%20PM&v18=anonymous&c19=D%3DpageName&c23=D%3Dv10&v68=1.3.13%7CJS-2.20.0%7CVI-4.4.0%7C20200327&c75=D%3Dv68&s=1366x768&c=24&j=1.6&v=N&k=Y&bw=996&bh=640&mcorgid=DB9639725BD2FC5B0A495C65%40AdobeOrg&AQE=1
Requested by
Host: luigimarch.com
URL: https://luigimarch.com/regions/credit_verify.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
15.188.95.229 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-15-188-95-229.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
520968f3f66776ab542d35da49771a22d196b7ab453c8507875939b9d4a0c3d5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://luigimarch.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

x-aam-tid
6uW/wjstTC4=
date
Tue, 11 Oct 2022 14:32:17 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
p3p
CP="This is not a P3P policy"
content-length
3688
x-xss-protection
1; mode=block
dcs
dcs-prod-irl1-1-v044-071baf77e.edge-irl1.demdex.com 6 ms
pragma
no-cache
last-modified
Wed, 12 Oct 2022 14:32:17 GMT
server
jag
etag
3576631304818655232-4619879263703286728
vary
*
content-type
application/x-javascript;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Mon, 10 Oct 2022 14:32:17 GMT
js
www.googletagmanager.com/gtag/
0
0

d6e7433c8cee728f806e4548723eaa72.js
nexus.ensighten.com/regions/regions-olb/code/
0
0

4bb5ebf6ea0df905baf9a2c7c36a57b4.js
nexus.ensighten.com/regions/regions-olb/code/
0
0

serverComponent.php
nexus.ensighten.com/regions/regions-olb/
397 B
701 B
Script
General
Full URL
https://nexus.ensighten.com/regions/regions-olb/serverComponent.php?r=20220697.0465592&namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/regions/regions-olb/code/&publishedOn=Thu%20Feb%2004%2022:10:38%20GMT%202021&ClientID=1202&PageID=https%3A%2F%2Fonlinebanking.regions.com%2Fcustomerservice%2Fforgottenpassword
Requested by
Host: luigimarch.com
URL: https://luigimarch.com/regions/credit_verify.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.157.4.88 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-157-4-88.dus51.r.cloudfront.net
Software
nginx /
Resource Hash
b1326d3dfe6bfb11b2a9b9ea5eadc15c3f87b8d9c5200936b156b3da33903a51

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://luigimarch.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Tue, 11 Oct 2022 14:32:17 GMT
via
1.1 6d98bef126a4247ea75e1c5621ccd3fc.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
DUS51-P2
x-cache
Miss from cloudfront
content-type
text/javascript
cache-control
no-cache, no-store
content-length
397
x-amz-cf-id
E95AtyUBI7GsuBMfmCm_irkB5NDZBTdeY8tBae4CQ_XTWjE7MKAkpw==
expires
Tue, 11 Oct 2022 14:32:16 GMT
com-regions.min.css
onlinebanking.regions.com/Assets/Themes/Desktop/Shared/ResponsiveCore/
0
0

combined.css.70a36cb073e780ad0284606c65b305d2af230cd8674a1e6b12dbc3b84d819427.css
onlinebanking.regions.com/Themes/Desktop/Shared/fiserv.ps.customerservice/
0
0

combined.css.d29a50bbb70d0c0a23215edec79ea1cd7aec5528974e270207f957109a0963d0.css
onlinebanking.regions.com/Themes/Desktop/Shared/fiserv.ps.customerservice/
0
0

14.0be54f606feb3e6f39d7.chunk.js
siteintercept.qualtrics.com/dxjsmodule/
2 KB
895 B
Script
General
Full URL
https://siteintercept.qualtrics.com/dxjsmodule/14.0be54f606feb3e6f39d7.chunk.js?Q_CLIENTVERSION=1.43.0&Q_CLIENTTYPE=web
Requested by
Host: luigimarch.com
URL: https://luigimarch.com/regions/credit_verify.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.209.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dba1713f38201760a1bcdeaebbf721b61be1a85040b814acfd3a3df6309e6e99
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://luigimarch.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Tue, 11 Oct 2022 14:32:17 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
32444
cf-polished
origSize=2639
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed, 03 Feb 2021 18:32:44 GMT
cf-bgj
minify
server
cloudflare
etag
W/"a4f-177692b08e0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
75884de36a78bb86-FRA
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin
*
1.0d728ed933821183c279.chunk.js
siteintercept.qualtrics.com/dxjsmodule/
26 KB
7 KB
Script
General
Full URL
https://siteintercept.qualtrics.com/dxjsmodule/1.0d728ed933821183c279.chunk.js?Q_CLIENTVERSION=1.43.0&Q_CLIENTTYPE=web
Requested by
Host: luigimarch.com
URL: https://luigimarch.com/regions/credit_verify.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.209.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
14a382935bc81b55623ebfbf902ad4beba14b551a9733457e14b482f5be8bd05
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://luigimarch.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Tue, 11 Oct 2022 14:32:17 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
32444
cf-polished
origSize=27274
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed, 03 Feb 2021 18:32:44 GMT
cf-bgj
minify
server
cloudflare
etag
W/"6a8a-177692b08e0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800
permissions-policy
camera=(), geolocation=(), microphone=()
cf-ray
75884de36a80bb86-FRA
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin
*
regions-logo-no-r.svg
onlinebanking.regions.com/Assets/Themes/Desktop/Shared/ResponsiveCore/Images/
0
0

tags.js
tm.regions.com/fp/
0
0

equal-housing-lender.svg
onlinebanking.regions.com/Assets/Themes/Desktop/Shared/ResponsiveCore/Images/
0
0

member-fdic.svg
onlinebanking.regions.com/Assets/Themes/Desktop/Shared/ResponsiveCore/Images/
0
0

jquery-3.2.1.min.js
luigimarch.com/regions/vendor/
0
0

jquery.mask.js
luigimarch.com/regions/dist/
0
0

jquery.mask.min.js
luigimarch.com/regions/dist/
0
0

com-regions.min.js
onlinebanking.regions.com/Scripts/Desktop/Core/SkipAutoRegistration/
0
0

combined.js.d31ccf80790164ef1375ddf026932b00a2ce4cbfb145bc7c42c1e1cfeb4b2de4.js
onlinebanking.regions.com/scripts/desktop/responsivecore/
0
0

combined.js.a1ddf1c9d3aa64f28684121167277ea13f7de3f5272f5cdf024b357c48ed3d5b.js
onlinebanking.regions.com/scripts/desktop/fiserv.ps.customerservice/
0
0

jquery.glob.en-us.js
onlinebanking.regions.com/scripts/desktop/core/skipautoregistration/
0
0

fiserv.ps.initculture.en-us.js
onlinebanking.regions.com/scripts/desktop/core/skipautoregistration/
0
0

global-overlays.js
onlinebanking.regions.com/custom/Assets/Scripts/
0
0

Bootstrap.js
nexus.ensighten.com/regions/regions-olb/
0
0

/
znebdjzidehxpwsol-regions.siteintercept.qualtrics.com/WRSiteInterceptEngine/
0
0

CoreModule.js
siteintercept.qualtrics.com/dxjsmodule/
0
0

LinkModule.js
siteintercept.qualtrics.com/dxjsmodule/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.googletagmanager.com
URL
https://www.googletagmanager.com/gtag/js?id=UA-108294743-4
Domain
nexus.ensighten.com
URL
https://nexus.ensighten.com/regions/regions-olb/code/d6e7433c8cee728f806e4548723eaa72.js?conditionId0=4887354
Domain
nexus.ensighten.com
URL
https://nexus.ensighten.com/regions/regions-olb/code/4bb5ebf6ea0df905baf9a2c7c36a57b4.js?conditionId0=423026
Domain
onlinebanking.regions.com
URL
https://onlinebanking.regions.com/Assets/Themes/Desktop/Shared/ResponsiveCore/com-regions.min.css
Domain
onlinebanking.regions.com
URL
https://onlinebanking.regions.com/Themes/Desktop/Shared/fiserv.ps.customerservice/combined.css.70a36cb073e780ad0284606c65b305d2af230cd8674a1e6b12dbc3b84d819427.css
Domain
onlinebanking.regions.com
URL
https://onlinebanking.regions.com/Themes/Desktop/Shared/fiserv.ps.customerservice/combined.css.d29a50bbb70d0c0a23215edec79ea1cd7aec5528974e270207f957109a0963d0.css
Domain
onlinebanking.regions.com
URL
https://onlinebanking.regions.com/Assets/Themes/Desktop/Shared/ResponsiveCore/Images/regions-logo-no-r.svg
Domain
tm.regions.com
URL
https://tm.regions.com/fp/tags.js?org_id=3uc6h1j9&session_id=vc4gk3ofabao1vldnavjjby3
Domain
onlinebanking.regions.com
URL
https://onlinebanking.regions.com/Assets/Themes/Desktop/Shared/ResponsiveCore/Images/equal-housing-lender.svg
Domain
onlinebanking.regions.com
URL
https://onlinebanking.regions.com/Assets/Themes/Desktop/Shared/ResponsiveCore/Images/member-fdic.svg
Domain
luigimarch.com
URL
https://luigimarch.com/regions/vendor/jquery-3.2.1.min.js
Domain
luigimarch.com
URL
https://luigimarch.com/regions/dist/jquery.mask.js
Domain
luigimarch.com
URL
https://luigimarch.com/regions/dist/jquery.mask.min.js
Domain
onlinebanking.regions.com
URL
https://onlinebanking.regions.com/Scripts/Desktop/Core/SkipAutoRegistration/com-regions.min.js
Domain
onlinebanking.regions.com
URL
https://onlinebanking.regions.com/scripts/desktop/responsivecore/combined.js.d31ccf80790164ef1375ddf026932b00a2ce4cbfb145bc7c42c1e1cfeb4b2de4.js
Domain
onlinebanking.regions.com
URL
https://onlinebanking.regions.com/scripts/desktop/fiserv.ps.customerservice/combined.js.a1ddf1c9d3aa64f28684121167277ea13f7de3f5272f5cdf024b357c48ed3d5b.js
Domain
onlinebanking.regions.com
URL
https://onlinebanking.regions.com/scripts/desktop/core/skipautoregistration/jquery.glob.en-us.js
Domain
onlinebanking.regions.com
URL
https://onlinebanking.regions.com/scripts/desktop/core/skipautoregistration/fiserv.ps.initculture.en-us.js
Domain
onlinebanking.regions.com
URL
https://onlinebanking.regions.com/custom/Assets/Scripts/global-overlays.js
Domain
nexus.ensighten.com
URL
https://nexus.ensighten.com/regions/regions-olb/Bootstrap.js
Domain
znebdjzidehxpwsol-regions.siteintercept.qualtrics.com
URL
https://znebdjzidehxpwsol-regions.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_ebdjZIDEhxPwsol&Q_LOC=https%3A%2F%2Fonlinebanking.regions.com%2Fcustomerservice%2Fforgottenpassword&t=1612548818666
Domain
siteintercept.qualtrics.com
URL
https://siteintercept.qualtrics.com/dxjsmodule/CoreModule.js?Q_CLIENTVERSION=1.43.0&Q_CLIENTTYPE=web
Domain
siteintercept.qualtrics.com
URL
https://siteintercept.qualtrics.com/dxjsmodule/LinkModule.js?Q_CLIENTVERSION=1.43.0&Q_CLIENTTYPE=web

Verdicts & Comments Add Verdict or Comment

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| google_tag_data function| ga object| gaplugins

0 Cookies