mcd-shopping.shop
Open in
urlscan Pro
172.67.146.84
Malicious Activity!
Public Scan
Submission: On December 11 via api from BE — Scanned from FR
Summary
TLS certificate: Issued by WE1 on December 6th 2024. Valid for: 3 months.
This is the only time mcd-shopping.shop was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: MercadoLibre (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 172.67.146.84 172.67.146.84 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 104.17.24.14 104.17.24.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a02:26f0:350... 2a02:26f0:3500:880::523 | 20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.) | |
8 | 3 |
ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
res.cloudinary.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 225 |
49 KB |
3 |
mcd-shopping.shop
mcd-shopping.shop |
4 KB |
1 |
cloudinary.com
res.cloudinary.com — Cisco Umbrella Rank: 2559 |
1 MB |
8 | 3 |
Domain | Requested by | |
---|---|---|
4 | cdnjs.cloudflare.com |
mcd-shopping.shop
|
3 | mcd-shopping.shop |
mcd-shopping.shop
|
1 | res.cloudinary.com |
mcd-shopping.shop
|
8 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
mcd-shopping.shop WE1 |
2024-12-06 - 2025-03-06 |
3 months | crt.sh |
cdnjs.cloudflare.com WE1 |
2024-11-26 - 2025-02-24 |
3 months | crt.sh |
*.cloudinary.com Go Daddy Secure Certificate Authority - G2 |
2023-12-18 - 2025-01-13 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://mcd-shopping.shop/
Frame ID: 0B3782DE9800F134CCB98FEAC93DCA00
Requests: 8 HTTP requests in this frame
Screenshot
Page Title
Mercado LibreDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Popper (Miscellaneous) Expand
Detected patterns
- <script [^>]*src="[^"]*/popper\.js/([0-9.]+)
- /popper\.js/([0-9.]+)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
/
mcd-shopping.shop/ |
5 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.css
cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/5.1.0/css/ |
159 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/css/ |
58 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
style.css
mcd-shopping.shop/css-js/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/2.9.2/umd/ |
18 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.js
cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/5.1.0/js/ |
58 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p0dysuq95vwnmresa2pt.jpg
res.cloudinary.com/dx1zztojj/image/upload/v1726204992/ |
1 MB 1 MB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
mcd-shopping.shop/ |
445 B 967 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: MercadoLibre (Consumer)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| Popper number| uidEvent object| bootstrap1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
mcd-shopping.shop/ | Name: s7b29b545 Value: rpf2nc7g84far09tid3fc8d0hh |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
mcd-shopping.shop
res.cloudinary.com
104.17.24.14
172.67.146.84
2a02:26f0:3500:880::523
488942d581f1001414dfa78520b21c417a6bb61d1af405b306eaa3283484a4d7
5a07c69f9061eb12e39a031358a4f567f30a002ad6182639ac84fd1bda2f6e65
65a565df0e2169949e07dde9165f318cda1e0c2b4233ce83cd9b15b358a06c36
7382e5e9e48883a128b6193ca4258017c684f76dc4bed535d69aa3072f8d8cd3
99464ceb71bc9bbdcc72275faefe44f98eb5cbb6b5d8ee665b87b35376f1a96e
cfc391e34328c09f0680ae8ff3d63e86224ae7e71c973147ccb84540b2fdd9b8
e8bd3e5ea541898859f16d4508c536a7a471b36b0808f7d5e72fc9bdc1f877bb