www-0632050.lon.wafaicloud.com Open in urlscan Pro
185.206.28.146  Malicious Activity! Public Scan

URL: https://www-0632050.lon.wafaicloud.com/
Submission Tags: 7290850
Submission: On September 13 via api from NL — Scanned from DE

Summary

This website contacted 5 IPs in 4 countries across 5 domains to perform 10 HTTP transactions. The main IP is 185.206.28.146, located in Saudi Arabia and belongs to DSP-AS, SA. The main domain is www-0632050.lon.wafaicloud.com.
TLS certificate: Issued by R3 on July 21st 2021. Valid for: 3 months.
This is the only time www-0632050.lon.wafaicloud.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Mercado Pago (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 185.206.28.146 202105 (DSP-AS)
5 173.222.106.136 20940 (AKAMAI-ASN1)
1 142.250.27.105 15169 (GOOGLE)
1 151.101.114.137 54113 (FASTLY)
2 162.247.242.19 23467 (NEWRELIC-...)
10 5
Domain Requested by
5 http2.mlstatic.com www-0632050.lon.wafaicloud.com
2 bam.nr-data.net js-agent.newrelic.com
www-0632050.lon.wafaicloud.com
1 js-agent.newrelic.com www-0632050.lon.wafaicloud.com
1 www.google.com www-0632050.lon.wafaicloud.com
1 www-0632050.lon.wafaicloud.com
10 5

This site contains links to these domains. Also see Links.

Domain
www.mercadopago.com.br
registration.mercadopago.com.br
Subject Issuer Validity Valid
*.lon.wafaicloud.com
R3
2021-07-21 -
2021-10-19
3 months crt.sh
*.mlstatic.com
DigiCert SHA2 Secure Server CA
2021-07-25 -
2022-07-27
a year crt.sh
www.google.com
GTS CA 1C3
2021-08-23 -
2021-11-15
3 months crt.sh
*.newrelic.com
R3
2021-07-19 -
2021-10-17
3 months crt.sh
*.nr-data.net
DigiCert SHA2 Secure Server CA
2020-02-05 -
2022-02-08
2 years crt.sh

This page contains 1 frames:

Primary Page: https://www-0632050.lon.wafaicloud.com/
Frame ID: 76E9F6B6BA84CA4E75F850426C648226
Requests: 10 HTTP requests in this frame

Screenshot

Page Title

Olá! Digite o seu e-mail ou usuário

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]+recaptcha

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

5
IPs

4
Countries

70 kB
Transfer

149 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www-0632050.lon.wafaicloud.com/
80 KB
19 KB
Document
General
Full URL
https://www-0632050.lon.wafaicloud.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.206.28.146 , Saudi Arabia, ASN202105 (DSP-AS, SA),
Reverse DNS
Software
openresty /
Resource Hash
108cc8fc53a43c2d7a12beabef5109f1948a94a91df5c1d1eabab3e63ab6795d
Security Headers
Name Value
Strict-Transport-Security max-age=15811200

Request headers

:method
GET
:authority
www-0632050.lon.wafaicloud.com
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

server
openresty
date
Mon, 13 Sep 2021 21:21:38 GMT
content-type
text/html; charset=UTF-8
content-length
19327
set-cookie
PHPSESSID=435e25667cc96bc466be89386adfcc52; path=/
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
vary
Accept-Encoding
content-encoding
gzip
x-resolver-ip
185.206.28.146
strict-transport-security
max-age=15811200
proximanova-light.woff2
http2.mlstatic.com/ui/webfonts/v3.0.0/proxima-nova/
14 KB
14 KB
Font
General
Full URL
https://http2.mlstatic.com/ui/webfonts/v3.0.0/proxima-nova/proximanova-light.woff2
Requested by
Host: www-0632050.lon.wafaicloud.com
URL: https://www-0632050.lon.wafaicloud.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
173.222.106.136 Milan, Italy, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a173-222-106-136.deploy.static.akamaitechnologies.com
Software
Tengine /
Resource Hash
9bb769c5a9f25f8d52e9ba56881641ec0ca019da478cf2910457fdbea01fcd14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www-0632050.lon.wafaicloud.com/
Origin
https://www-0632050.lon.wafaicloud.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-object-meta-x-swift-migration-status
migrated
date
Mon, 13 Sep 2021 21:21:38 GMT
x-content-type-options
nosniff
x-d2id
ec7edf9c-0c65-4144-a177-37b3856f57a9
id
25136
content-length
14076
x-xss-protection
1; mode=block
x-request-id
ec7edf9c-0c65-4144-a177-37b3856f57a9
last-modified
Tue, 25 Jun 2019 04:55:16 GMT
server
Tengine
etag
0de1fd16bf20e0b68646e390d439ab42
content-type
application/octet-stream
access-control-allow-origin
*
x-timestamp
1561438515
cache-control
public, max-age=31536000
accept-ranges
bytes
proximanova-regular.woff2
http2.mlstatic.com/ui/webfonts/v3.0.0/proxima-nova/
14 KB
14 KB
Font
General
Full URL
https://http2.mlstatic.com/ui/webfonts/v3.0.0/proxima-nova/proximanova-regular.woff2
Requested by
Host: www-0632050.lon.wafaicloud.com
URL: https://www-0632050.lon.wafaicloud.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
173.222.106.136 Milan, Italy, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a173-222-106-136.deploy.static.akamaitechnologies.com
Software
Tengine /
Resource Hash
9411ab12b8dd65ce03ea7e1c62557fc2d1eaa1d5d1493609a14a2e29b8342918
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www-0632050.lon.wafaicloud.com/
Origin
https://www-0632050.lon.wafaicloud.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-object-meta-x-swift-migration-status
migrated
date
Mon, 13 Sep 2021 21:21:38 GMT
x-content-type-options
nosniff
x-d2id
ba91f8e9-f4c0-4a23-8b6f-ca3b936969aa
id
28508
content-length
14076
x-xss-protection
1; mode=block
x-request-id
ba91f8e9-f4c0-4a23-8b6f-ca3b936969aa
last-modified
Tue, 25 Jun 2019 04:55:17 GMT
server
Tengine
etag
67ff311675dbd02ddb898f02af6fddaf
content-type
application/octet-stream
access-control-allow-origin
*
x-timestamp
1561438516
cache-control
public, max-age=31536000
accept-ranges
bytes
enterprise.js
www.google.com/recaptcha/
1 KB
1 KB
Script
General
Full URL
https://www.google.com/recaptcha/enterprise.js?onload=onloadCallback&render=6LelVV4UAAAAADm4qkzt85y1Qh_n-JeoqwYIfX9u&hl=pt-BR
Requested by
Host: www-0632050.lon.wafaicloud.com
URL: https://www-0632050.lon.wafaicloud.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.27.105 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
ra-in-f105.1e100.net
Software
GSE /
Resource Hash
668d9ab7dd78751c58d6be9302c57e6e65b5589d1502c7d9b95ac9fc9606f14e
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www-0632050.lon.wafaicloud.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Mon, 13 Sep 2021 21:21:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
content-security-policy
frame-ancestors 'self'
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
642
x-xss-protection
1; mode=block
expires
Mon, 13 Sep 2021 21:21:38 GMT
70705a3fe2cba7943ed00b0b45eae33a.svg
http2.mlstatic.com/frontend-assets/auth-login-frontend/
13 KB
6 KB
Image
General
Full URL
https://http2.mlstatic.com/frontend-assets/auth-login-frontend/70705a3fe2cba7943ed00b0b45eae33a.svg
Requested by
Host: www-0632050.lon.wafaicloud.com
URL: https://www-0632050.lon.wafaicloud.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
173.222.106.136 Milan, Italy, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a173-222-106-136.deploy.static.akamaitechnologies.com
Software
Tengine /
Resource Hash
9c6b5f969196f14e818b13b7ec0141173d66034834acda4b282f9e65b99786ce
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www-0632050.lon.wafaicloud.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-version-id
FlYL1kxIzRGPqHKHmeBP0i3IFye9s0Hb
content-encoding
gzip
x-content-type-options
nosniff
x-d2id
fea2cc7d-31c8-4a59-be8e-7ea0b1b32491
x-amz-request-id
VVA9MFXCBPCHCNPF
x-amz-server-side-encryption
AES256
x-envoy-upstream-service-time
38
x-amz-replication-status
COMPLETED
content-length
5951
x-amz-id-2
aVd6Y6mF4q05xIB6rWrErBedoO3W5d+7ojpJJF1Zf756zcHBIUvkcHu2UUMHNUINyxw7jOE4q+M=
x-request-id
fea2cc7d-31c8-4a59-be8e-7ea0b1b32491
referrer-policy
no-referrer-when-downgrade
last-modified
Fri, 28 Aug 2020 17:07:22 GMT
server
Tengine
etag
"70705a3fe2cba7943ed00b0b45eae33a"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
public, max-age=31536000, immutable
accept-ranges
bytes
date
Mon, 13 Sep 2021 21:21:38 GMT
x-request-device-id
fea2cc7d-31c8-4a59-be8e-7ea0b1b32491
9f137a27271b5e6fc3e2e1d9cb7a8783.svg
http2.mlstatic.com/frontend-assets/auth-login-frontend/
765 B
1 KB
Image
General
Full URL
https://http2.mlstatic.com/frontend-assets/auth-login-frontend/9f137a27271b5e6fc3e2e1d9cb7a8783.svg
Requested by
Host: www-0632050.lon.wafaicloud.com
URL: https://www-0632050.lon.wafaicloud.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
173.222.106.136 Milan, Italy, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a173-222-106-136.deploy.static.akamaitechnologies.com
Software
Tengine /
Resource Hash
9b7a6b50f666a8614e068aa420b10d1978d617a0393e8421666ae6ccdb603a45
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www-0632050.lon.wafaicloud.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-version-id
2ugg6sHFR8J0MDRXBBntGfgiblqzbrFJ
x-content-type-options
nosniff
x-d2id
a6df5c0e-cecf-4b51-95d8-17f86ccd7c63
x-amz-request-id
8QBWDGBN5MBG1H8M
x-amz-server-side-encryption
AES256
x-envoy-upstream-service-time
31
x-amz-replication-status
COMPLETED
content-length
765
x-amz-id-2
kEi9rMZ8DFno6Wh9XkHmuTLu7CTIbwEehItdHKsaa5o3HjBkoL6ZbVpArUjqjwevPjEMS0bWT+c=
x-request-id
a6df5c0e-cecf-4b51-95d8-17f86ccd7c63
last-modified
Fri, 28 Aug 2020 19:53:36 GMT
server
Tengine
etag
"9f137a27271b5e6fc3e2e1d9cb7a8783"
content-type
image/svg+xml
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=31536000, immutable
accept-ranges
bytes
date
Mon, 13 Sep 2021 21:21:38 GMT
nr-1177.min.js
js-agent.newrelic.com/
27 KB
11 KB
Script
General
Full URL
https://js-agent.newrelic.com/nr-1177.min.js
Requested by
Host: www-0632050.lon.wafaicloud.com
URL: https://www-0632050.lon.wafaicloud.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
67f243af83cf56b2fd0fb502ab9f7a8533500e2571b4459d5bf6f6481a2da4ca

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www-0632050.lon.wafaicloud.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-version-id
null
content-encoding
gzip
etag
"97c8d5802b0de603104986846cdc509a"
x-amz-request-id
MY3YAYPNTCHFJ9KC
x-cache
HIT
content-length
10405
x-amz-id-2
/ILM/TBp84pElArhL2vixDlPonqt/bON0n5stTd2RTPkwhYhcWzm/kyKxJSz1BskbcYvDkpj4o4=
x-served-by
cache-hhn4036-HHN
last-modified
Tue, 18 Aug 2020 17:23:32 GMT
server
AmazonS3
x-timer
S1631568099.832053,VS0,VE0
date
Mon, 13 Sep 2021 21:21:38 GMT
vary
Accept-Encoding
content-type
application/javascript
via
1.1 varnish
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
14
navigation.css
http2.mlstatic.com/ui/navigation/5.9.1/mercadopago/
0
3 KB
Other
General
Full URL
https://http2.mlstatic.com/ui/navigation/5.9.1/mercadopago/navigation.css
Requested by
Host: www-0632050.lon.wafaicloud.com
URL: https://www-0632050.lon.wafaicloud.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
173.222.106.136 Milan, Italy, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a173-222-106-136.deploy.static.akamaitechnologies.com
Software
Tengine /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www-0632050.lon.wafaicloud.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Mon, 13 Sep 2021 21:21:38 GMT
content-encoding
br
x-content-type-options
nosniff
x-d2id
c669bbbd-4b2d-4802-b395-858b798a9235
id
14800
x-envoy-upstream-service-time
80
content-length
2778
x-xss-protection
1; mode=block
x-request-id
c669bbbd-4b2d-4802-b395-858b798a9235
referrer-policy
no-referrer-when-downgrade
last-modified
Thu, 20 Aug 2020 16:17:09 GMT
server
Tengine
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-timestamp
1597940228
cache-control
public, max-age=13620170
3009922991
bam.nr-data.net/1/
57 B
322 B
Script
General
Full URL
https://bam.nr-data.net/1/3009922991?a=42549344&v=1177.96a4d39&to=bgRaYENYWBdWABdfXVdOe0FCTVkJGBUKU0UWFEtRQw%3D%3D&rst=273&ck=1&ref=https://www-0632050.lon.wafaicloud.com/&ap=65.285118&be=153&fe=236&dc=157&tt=5667d8a6f571b4&af=err,xhr,stn,ins&perf=%7B%22timing%22:%7B%22of%22:1631568098569,%22n%22:0,%22f%22:1,%22dn%22:2,%22dne%22:43,%22c%22:43,%22s%22:63,%22ce%22:86,%22rq%22:86,%22rp%22:129,%22rpe%22:131,%22dl%22:134,%22di%22:157,%22ds%22:157,%22de%22:157,%22dc%22:236,%22l%22:236,%22le%22:238%7D,%22navigation%22:%7B%7D%7D&fp=225&fcp=225&jsonp=NREUM.setToken
Requested by
Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1177.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
162.247.242.19 , United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
bam-7.nr-data.net
Software
/
Resource Hash
d10c94b6cdb747904baee9070f003bb45849da46f8100b1320f286c21cbcaaa1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www-0632050.lon.wafaicloud.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Cross-Origin-Resource-Policy
cross-origin
Content-Type
text/javascript;charset=iso-8859-1
Content-Length
57
Expires
Thu, 01 Jan 1970 00:00:00 GMT
3009922991
bam.nr-data.net/resources/1/
0
147 B
XHR
General
Full URL
https://bam.nr-data.net/resources/1/3009922991?a=42549344&v=1177.96a4d39&to=bgRaYENYWBdWABdfXVdOe0FCTVkJGBUKU0UWFEtRQw%3D%3D&rst=701&ck=1&ref=https://www-0632050.lon.wafaicloud.com/&st=1631568098569
Requested by
Host: www-0632050.lon.wafaicloud.com
URL: https://www-0632050.lon.wafaicloud.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
162.247.242.19 , United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
bam-7.nr-data.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www-0632050.lon.wafaicloud.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
content-type
text/plain

Response headers

Access-Control-Allow-Origin
https://www-0632050.lon.wafaicloud.com
Access-Control-Allow-Credentials
true
Content-Length
0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Mercado Pago (Consumer)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster object| NREUM object| newrelic function| __nr_require

2 Cookies

Domain/Path Name / Value
www-0632050.lon.wafaicloud.com/ Name: PHPSESSID
Value: 435e25667cc96bc466be89386adfcc52
.nr-data.net/ Name: JSESSIONID
Value: 9d96a8129942b9d2

1 Console Messages

Source Level URL
Text
javascript warning URL: https://www-0632050.lon.wafaicloud.com/
Message:
The resource https://www.google.com/recaptcha/enterprise.js?onload=onloadCallback&render=6LelVV4UAAAAADm4qkzt85y1Qh_n-JeoqwYIfX9u&hl=pt-BR was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=15811200