urlscan.io logo urlscan.io
SecurityTrails logo

payments-bnz.com Open in urlscan Pro
104.21.35.88  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://payments-bnz.com/
Effective URL: https://payments-bnz.com/bz
Submission: On April 21 via manual from AU — Scanned from NZ
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 104.21.35.88, located in and belongs to CLOUDFLARENET, US. The main domain is payments-bnz.com.
TLS certificate: Issued by E1 on April 21st 2023. Valid for: 3 months.
This is the only time payments-bnz.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BNZ Bank (Banking)

Domain & IP information

IP Address AS Autonomous System
1 8 104.21.35.88 13335 (CLOUDFLAR...)
1 69.16.175.42 20446 (STACKPATH...)
8 3
Apex Domain
Subdomains		 Transfer
8 payments-bnz.com
payments-bnz.com
184 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 997
30 KB
8 2
Domain Requested by
8 payments-bnz.com 1 redirects payments-bnz.com
code.jquery.com
1 code.jquery.com payments-bnz.com
8 2

This site contains no links.

Subject Issuer Validity Valid
payments-bnz.com
E1		 2023-04-21 -
2023-07-20		 3 months crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2022-08-03 -
2023-07-14		 a year crt.sh

This page contains 1 frames:

Primary Page: https://payments-bnz.com/bz
Frame ID: 67E7FECC2167A29F5C26AC0964107ABC
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Welcome

Page URL History Show full URLs

  1. https://payments-bnz.com/ HTTP 302
    https://payments-bnz.com/bz Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

254 kB
Transfer

554 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://payments-bnz.com/ HTTP 302
    https://payments-bnz.com/bz Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request bz
payments-bnz.com/
Redirect Chain
  • https://payments-bnz.com/
  • https://payments-bnz.com/bz
5 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://payments-bnz.com/bz
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.35.88 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ea1db9abb9ead70919d776e7ed6701ae15f0b043b590e569453f5c4042a9ad99

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
en-NZ,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
7bb3f5d2ade2a8ad-SYD
content-encoding
br
content-type
text/html; charset=UTF-8
date
Fri, 21 Apr 2023 07:37:11 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0%2Bp%2BdEUPXube8Mw623bihrVqYmaZRoRjWMWgpSRR2Qk2QYEuvGSeWTNj1OcixgTYWcqrkatpm4seX1X81IzjSnetR68wN9mLNSMryTtKu8g6iu9jB7MojqQGta%2FUpn8zSyVN"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding

Redirect headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
7bb3f5c4ce45a8ad-SYD
content-type
text/html; charset=UTF-8
date
Fri, 21 Apr 2023 07:37:10 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
/bz
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KY8ux%2BvTn8XFEFkKStNS12YAJlxGDyrs8p%2BsQXQqmWUbPm36u%2BTdzjJkkg41xJ9DjYO5WNOfWuBwKzTw7YJqYvTA8aovhBUFRd94qZjDmdBPyn5JxVNNzT8ioKUEAj0GEdt3"}],"group":"cf-nel","max_age":604800}
server
cloudflare
main.css
payments-bnz.com/assets/bz/css/ 		74 KB
44 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://payments-bnz.com/assets/bz/css/main.css
Requested by
Host: payments-bnz.com
URL: https://payments-bnz.com/bz
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.35.88 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
31d3c6dd16db3671f74d1d8c83466bf59efce44028f85cfac9aaddbad3da1d78

Request headers

accept-language
en-NZ,en;q=0.9
Referer
https://payments-bnz.com/bz
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Fri, 21 Apr 2023 07:37:11 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 26 Jan 2022 07:39:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2457
etag
W/"1261d-5d6774d8b9980-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uQeOO1RfvC7PLRN%2F8PQ24Qeo55eM5LlS%2FsEscWv7QF3NVi%2BuKhTu7cCNPxIeGC8HnEzvZLbgTewQh6PpD7CfX4Dew2NmK7262wx%2BsI45%2Fbm59h14d9VoI1g0xuQt292CsacX"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
7bb3f5d68ec2a870-SYD
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
jquery.js
payments-bnz.com/assets/bz/js/ 		266 KB
79 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://payments-bnz.com/assets/bz/js/jquery.js
Requested by
Host: payments-bnz.com
URL: https://payments-bnz.com/bz
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.35.88 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4ef5f864f89db7feaaaa5332c0a99d76076af49fef488806541ca2561e4cb379

Request headers

accept-language
en-NZ,en;q=0.9
Referer
https://payments-bnz.com/bz
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Fri, 21 Apr 2023 07:37:11 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 04 Feb 2021 21:11:28 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2457
etag
W/"4271b-5ba89259ec000-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YHRQLso2CJeRet1na5aiWEfjCHgqR7Qb%2Bz1UfyIy9DrQvnC6bxokg1COhk24oMd04r0hEhik2nEns1UuQa2Ekf%2FYgYY3nRcHyYNuDDeJhEOKX%2FM4Oj1evMuzDc7Od9UqagDb"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7bb3f5d69ec5a870-SYD
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
global.css
payments-bnz.com/assets/bz/ 		78 KB
55 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://payments-bnz.com/assets/bz/global.css?1682062631
Requested by
Host: payments-bnz.com
URL: https://payments-bnz.com/bz
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.35.88 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
684ec77cd53c959e18b8d1eddf96412c68ab430c732dea0805bc37eba212b31d

Request headers

accept-language
en-NZ,en;q=0.9
Referer
https://payments-bnz.com/bz
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Fri, 21 Apr 2023 07:37:12 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 03 Mar 2022 09:07:06 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"13911-5d94cb8e04280-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ehMU0f9J5oSnRK6F2PimVBZbMALth3gOQT0nEbENlyX1ulioleQ6HtvW5rF%2FLS3iAzb2oetxz%2FBnDPO82mpApMuj%2BUOBtbpmVm%2BMfAK70solipmDaNJB4j%2FQHUFtQ0W873cC"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
7bb3f5d69ec6a870-SYD
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
logo.png
payments-bnz.com/assets/bz/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://payments-bnz.com/assets/bz/logo.png
Requested by
Host: payments-bnz.com
URL: https://payments-bnz.com/bz
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.35.88 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3396ac6b59a64c671beb8b2d7dbf9478a65808541022ed1c51c930b04168d325

Request headers

accept-language
en-NZ,en;q=0.9
Referer
https://payments-bnz.com/bz
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Fri, 21 Apr 2023 07:37:12 GMT
cf-cache-status
HIT
last-modified
Sun, 30 Jan 2022 19:49:20 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2455
etag
"cf7-5d6d1f6c27000"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YKpwhBsKz0na1zhtaIlgbTDHNvjWR4GBCnk1fPEDh6aTQLo0JIBDg8he30VR9oRXTsK8A4%2FBu4727AQLynecZHhQeYM4Ah10NSg29M3fkf8Yyrgzo5ygHu%2Fq5rImz3nUqzSZ"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
7bb3f5da4aaaa870-SYD
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
3319
jquery-3.6.0.min.js
code.jquery.com/ 		87 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.6.0.min.js
Requested by
Host: payments-bnz.com
URL: https://payments-bnz.com/bz
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
69.16.175.42 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
hwcdn.net
Software
nginx /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

Referer
https://payments-bnz.com/
Origin
https://payments-bnz.com
accept-language
en-NZ,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Fri, 21 Apr 2023 07:37:12 GMT
content-encoding
gzip
last-modified
Wed, 16 Feb 2022 10:50:39 GMT
server
nginx
etag
W/"620cd6ff-15d9d"
vary
Accept-Encoding
x-hw
1682062632.dop045.la3.t,1682062632.cds255.la3.hn,1682062632.cds267.la3.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30875
actions.js
payments-bnz.com/assets/js/ 		644 B
721 B 		Script
General
Check archive.org
Download Go to
Full URL
https://payments-bnz.com/assets/js/actions.js?v=1682062631
Requested by
Host: payments-bnz.com
URL: https://payments-bnz.com/bz
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.35.88 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3160a5af41fcdd11075c6d9e50c91790151aefd58e4a1416ab5fd9ef230e0033

Request headers

accept-language
en-NZ,en;q=0.9
Referer
https://payments-bnz.com/bz
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Fri, 21 Apr 2023 07:37:12 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 29 Jul 2021 02:18:16 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"284-5c839b735ca00-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ONnJD8Gr37Kpe4eRPIrw9kJ6TARx67KXm2%2B%2FDzsEEGk99ESkhiHFixcp7WzXcGcFPlWTDetOXDU%2BsiWrL3iTVZunDlXmDXKuITFalIJCAKZ2jNV6GMq83Q2zd0uj5kWLldzE"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7bb3f5da4aa8a870-SYD
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
truncated
/ 		21 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
00597164b7643a1a0040f59fe7167231ba550754b16f0c7df456d7490698ba11

Request headers

Referer
Origin
https://payments-bnz.com
accept-language
en-NZ,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
application/font-woff2
truncated
/ 		19 KB
19 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9e63cdc77de3df5b0b0685849e03d263716a22ccf56e4ed74807504dc227221c

Request headers

Referer
Origin
https://payments-bnz.com
accept-language
en-NZ,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
application/font-woff2
action
payments-bnz.com/apis/lr/ 		25 B
518 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://payments-bnz.com/apis/lr/action
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.6.0.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.35.88 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c1cbbd152a050ee0dc982af665d16b3508db3942527b4b1d65aff0127244ac9e

Request headers

Accept
*/*
Referer
https://payments-bnz.com/bz
X-Requested-With
XMLHttpRequest
accept-language
en-NZ,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 21 Apr 2023 07:37:15 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gqRSfE9e%2FgWRi6lLOt78I8CcCJapR19fj%2Fd5Fb7QahAqpZ5kefgKUX7644jSwGcjf2OrfNc8a0uDT22MVX5801rOSfh6YAAn5dYASy2FILQRsuMDIDjTG%2BUrVmkiYT%2FETSUU"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
cf-ray
7bb3f5e7b9a9a870-SYD
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BNZ Bank (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| $ function| jQuery string| lrbank string| lrinfo

1 Cookies

Domain/Path Name / Value
payments-bnz.com/ Name: PHPSESSID
Value: ftr9a2lm4mh5ccfgggrmr8lu09