jessegray.co.nz Open in urlscan Pro
104.21.50.133 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://jessegray.co.nz/
Submission: On March 24 via manual (March 24th 2023, 12:41:49 am UTC) from MY — Scanned from NZ

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 104.21.50.133, located in and belongs to CLOUDFLARENET, US. The main domain is jessegray.co.nz.

This is the only time jessegray.co.nz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

	IP Address	AS Autonomous System
5	104.21.50.133 104.21.50.133	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	104.103.150.19 104.103.150.19	16625 (AKAMAI-AS) (AKAMAI-AS)
8	2

5 104.21.50.133 (None, )

ASN13335 (CLOUDFLARENET, US)

jessegray.co.nz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.103.150.19 (Singapore)

ASN16625 (AKAMAI-AS, US)
PTR: a104-103-150-19.deploy.static.akamaitechnologies.com

www15.wellsfargomedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	jessegray.co.nz jessegray.co.nz	675 KB
3	wellsfargomedia.com www15.wellsfargomedia.com — Cisco Umbrella Rank: 25683	71 KB
8	2

	Domain	Requested by
5	jessegray.co.nz	jessegray.co.nz
3	www15.wellsfargomedia.com	jessegray.co.nz
8	2

This site contains no links.

Subject Issuer	Validity	Valid
www15.wellsfargomedia.com DigiCert TLS RSA SHA256 2020 CA1	`2022-11-14` - `2023-11-16`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://jessegray.co.nz/
Frame ID: 9DC3072BEB9A842D18551478FBE2F761
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign On to View Your Personal Accounts | Wells Fargo

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

38 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

746 kB
Transfer

883 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
jessegray.co.nz/ 67 KB
10 KB 592ms
211ms Document
text/html 104.21.50.133
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://jessegray.co.nz/
Protocol: HTTP/1.1
Server: 104.21.50.133 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.3.33
Resource Hash: fbb9df60d162dd6bcc6851a391654a562fb7c03994aa3785fbe0c9f017c46056

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

CF-Cache-Status: DYNAMIC
CF-RAY: 7acadeb97f811c50-AKL
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Fri, 24 Mar 2023 00:41:42 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Pragma: no-cache
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n1PiiV13r6GpSSVBG934dDUQ0InhbmKcxM8NvMj9lM30ED6GYBls%2Bif%2BWNDU7Ny2DOfYdBpFqDTz2qmmACqdPdUmIDf86f2VXL4AVsnXUAP9NAFpO2zKv7QlMhuCTXCI%2Fto%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Powered-By: PHP/7.3.33
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H/1.1 200
OK index.css
jessegray.co.nz/wfu_assetz/css/ 32 KB
8 KB 308ms
189ms Stylesheet
text/css 104.21.50.133
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://jessegray.co.nz/wfu_assetz/css/index.css
Requested by: Host: jessegray.co.nz
URL: http://jessegray.co.nz/
Protocol: HTTP/1.1
Server: 104.21.50.133 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5160865ea1d4198101e9c07c7bfb2171d6ce2fb47d53e05597113d3f268b8c20

Request headers

accept-language: en-NZ,en;q=0.9
Referer: http://jessegray.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date: Fri, 24 Mar 2023 00:41:43 GMT
Content-Encoding: gzip
CF-Cache-Status: MISS
Last-Modified: Fri, 14 Oct 2022 14:02:30 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TLX4Sau6XznYU4kA9SzibthixTdAmWuEYSAHesnSvVN8M6KjxDxObKkeiSZHuGJsql114BvpuaDglEXsIMYW8DfNpnnWL%2FwfEJtWqSxhuV3cl%2BFmjhvbuGZTvt2WOfAuiJU%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: text/css
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 7acadebb9d71fb8c-AKL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 7701

GET
H/1.1 200
OK COB-BOB-IRT-enroll_balloons.jpg
jessegray.co.nz/wfu_assetz/img/ 611 KB
611 KB 350ms
214ms Image
image/jpeg 104.21.50.133
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://jessegray.co.nz/wfu_assetz/img/COB-BOB-IRT-enroll_balloons.jpg
Requested by: Host: jessegray.co.nz
URL: http://jessegray.co.nz/
Protocol: HTTP/1.1
Server: 104.21.50.133 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b8325d272c72a041414d9fb349e9d4bca5e7fc8ad66f47a719e491960afa5683

Request headers

accept-language: en-NZ,en;q=0.9
Referer: http://jessegray.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date: Fri, 24 Mar 2023 00:41:43 GMT
CF-Cache-Status: REVALIDATED
Last-Modified: Fri, 14 Oct 2022 01:46:50 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UYKKTnCageEOoaKzIKJvWAexZjPZRgH2OPyhsav8GN3NEIYRfwL60KfajePvOJ8WX7uaKDTm19mo5XN7AKQlVtXPfv334Oaj6Cg3mQpYOYBJ61tJvW%2F0eo%2FV43E9GguTdV0%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: image/jpeg
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 7acadebbbc961c54-AKL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 625433

GET
H/1.1 200
OK jquery.js Show response
jessegray.co.nz/wfu_assetz/js/ 87 KB
39 KB 292ms
190ms Script
application/javascript 104.21.50.133
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://jessegray.co.nz/wfu_assetz/js/jquery.js
Requested by: Host: jessegray.co.nz
URL: http://jessegray.co.nz/
Protocol: HTTP/1.1
Server: 104.21.50.133 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ce9d07500ad91ec2b524c270764ec4c9a33e78320d8d374ec400ede488f6251b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: http://jessegray.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date: Fri, 24 Mar 2023 00:41:43 GMT
Content-Encoding: gzip
CF-Cache-Status: REVALIDATED
Last-Modified: Tue, 04 Oct 2022 00:39:54 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9VrMK4KR6N5%2F6p9z%2Bt76cWzAkLxLj5x62W8KyrH2DWe8aTbemcpTDc2O63KDeN0clGufaFK46mYu7vGKUSj0XER8uCdu9spybE5R3gSvH207DOhSgjufMoM%2Bh2OFyn0Nomw%3D"}],"group":"cf-nel","max_age":604800}
Cache-Control: max-age=14400
Connection: keep-alive
CF-RAY: 7acadebb9f4dee96-AKL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H/1.1 200
OK misc.js Show response
jessegray.co.nz/wfu_assetz/js/ 16 KB
7 KB 389ms
270ms Script
application/javascript 104.21.50.133
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://jessegray.co.nz/wfu_assetz/js/misc.js
Requested by: Host: jessegray.co.nz
URL: http://jessegray.co.nz/
Protocol: HTTP/1.1
Server: 104.21.50.133 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 475575a56670c4ab3f05ca4b001674bbea9e6cbacaf9e0c0f2527a1aacdb9731

Request headers

accept-language: en-NZ,en;q=0.9
Referer: http://jessegray.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date: Fri, 24 Mar 2023 00:41:43 GMT
Content-Encoding: gzip
CF-Cache-Status: REVALIDATED
Last-Modified: Tue, 04 Oct 2022 00:39:54 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YuBY87fy3fuRMESraKwDCqF41TCN0CaDlJ7owq8uTCstj1%2BIeJNHyL81U%2BzZoQKfkLwxY5%2F5SQ4ktwrH%2BphRgckTbEl%2BMGEDl5pnvhGhQ1eDJ7lE1MwYrzgWit4s2se%2BL0o%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: application/javascript
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 7acadebbbe48fb88-AKL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 6508

GET
H2 200 wellsfargosans-rg.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ 22 KB
22 KB 1077ms
496ms Font
font/woff2 104.103.150.19
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-rg.woff2

Requested by

Host: jessegray.co.nz
URL: http://jessegray.co.nz/wfu_assetz/css/index.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.103.150.19 , Singapore, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-103-150-19.deploy.static.akamaitechnologies.com

Software

KONICHIWA/2.0 /

Resource Hash

631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://jessegray.co.nz/
Origin: http://jessegray.co.nz
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

unused62: 8096267
strict-transport-security: max-age=31536000; includeSubdomains;
date: Fri, 24 Mar 2023 00:41:43 GMT
x-content-type-options: nosniff
last-modified: Tue, 26 Feb 2019 19:38:34 GMT
server: KONICHIWA/2.0
etag: "5798-582d133e56280"
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 22424
x-xss-protection: 1; mode=block
expires: Sat, 23 Mar 2024 00:41:43 GMT

GET
H2 200 wellsfargoserif-rg.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ 26 KB
26 KB 1088ms
507ms Font
font/woff2 104.103.150.19
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargoserif-rg.woff2

Requested by

Host: jessegray.co.nz
URL: http://jessegray.co.nz/wfu_assetz/css/index.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.103.150.19 , Singapore, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-103-150-19.deploy.static.akamaitechnologies.com

Software

KONICHIWA/2.0 /

Resource Hash

aeb7b3bfc4281d35b02dfde05ac7a6c0d3daa7f3123b35a9cbd4b5a8e3f3c310

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://jessegray.co.nz/
Origin: http://jessegray.co.nz
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

unused62: 8096267
strict-transport-security: max-age=31536000; includeSubdomains;
date: Fri, 24 Mar 2023 00:41:43 GMT
x-content-type-options: nosniff
last-modified: Mon, 11 Mar 2019 20:52:01 GMT
server: KONICHIWA/2.0
etag: "6854-583d7be82be40"
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 26708
x-xss-protection: 1; mode=block
expires: Sat, 23 Mar 2024 00:41:43 GMT

GET
H2 200 wellsfargosans-sbd.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ 22 KB
22 KB 1606ms
1025ms Font
font/woff2 104.103.150.19
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-sbd.woff2

Requested by

Host: jessegray.co.nz
URL: http://jessegray.co.nz/wfu_assetz/css/index.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.103.150.19 , Singapore, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-103-150-19.deploy.static.akamaitechnologies.com

Software

KONICHIWA/2.0 /

Resource Hash

ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://jessegray.co.nz/
Origin: http://jessegray.co.nz
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

unused62: 8096267
strict-transport-security: max-age=31536000; includeSubdomains;
date: Fri, 24 Mar 2023 00:41:43 GMT
x-content-type-options: nosniff
last-modified: Tue, 26 Feb 2019 19:38:34 GMT
server: KONICHIWA/2.0
etag: "5848-582d133e56280"
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 22600
x-xss-protection: 1; mode=block
expires: Sat, 23 Mar 2024 00:41:43 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| $ function| jQuery object| $jscomp

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			jessegray.co.nz/	1969-12-31 23:59:59	Name: PHPSESSID Value: e10c38438a1cf862075514f66fb38013

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

jessegray.co.nz
www15.wellsfargomedia.com
104.103.150.19
104.21.50.133
475575a56670c4ab3f05ca4b001674bbea9e6cbacaf9e0c0f2527a1aacdb9731
5160865ea1d4198101e9c07c7bfb2171d6ce2fb47d53e05597113d3f268b8c20
631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc
ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba
aeb7b3bfc4281d35b02dfde05ac7a6c0d3daa7f3123b35a9cbd4b5a8e3f3c310
b8325d272c72a041414d9fb349e9d4bca5e7fc8ad66f47a719e491960afa5683
ce9d07500ad91ec2b524c270764ec4c9a33e78320d8d374ec400ede488f6251b
fbb9df60d162dd6bcc6851a391654a562fb7c03994aa3785fbe0c9f017c46056

jessegray.co.nz Open in urlscan Pro 104.21.50.133 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

8 Requests

38 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

746 kBTransfer

883 kBSize

1 Cookies

0 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

Indicators

jessegray.co.nz Open in urlscan Pro
104.21.50.133 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

38 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

746 kB
Transfer

883 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!