www.mercado-pago.duckdns.org Open in urlscan Pro
35.198.47.2  Malicious Activity! Public Scan

3 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response www.mercado-pago.duckdns.org/	184 KB 40 KB	814ms 211ms	Document text/html	35.198.47.2 GOOGLE-PRIVATE-CLOUD
General Check archive.org Show headers Download Go to Full URL http://www.mercado-pago.duckdns.org/ Protocol HTTP/1.1 Server 35.198.47.2 São Paulo, Brazil, ASN396982 (GOOGLE-PRIVATE-CLOUD, US), Reverse DNS 2.47.198.35.bc.googleusercontent.com Software Apache/2.4.41 (Ubuntu) / Resource Hash 5adeecfee91f5032d36cfc7d1acda895ce1280111ecb07d82cf1d0fd8e9505e6 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Date Wed, 02 Mar 2022 13:19:47 GMT Server Apache/2.4.41 (Ubuntu) Vary Accept-Encoding Content-Encoding gzip Content-Length 40527 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H2	200	proximanova-light.woff2 http2.mlstatic.com/ui/webfonts/v3.0.0/proxima-nova/	14 KB 14 KB	302ms 44ms	Font application/octet-stream	2.16.186.216 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://http2.mlstatic.com/ui/webfonts/v3.0.0/proxima-nova/proximanova-light.woff2 Requested by Host: www.mercado-pago.duckdns.org URL: http://www.mercado-pago.duckdns.org/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.186.216 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-186-216.deploy.static.akamaitechnologies.com Software Tengine / Resource Hash 9bb769c5a9f25f8d52e9ba56881641ec0ca019da478cf2910457fdbea01fcd14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer http://www.mercado-pago.duckdns.org/ Origin http://www.mercado-pago.duckdns.org Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers x-object-meta-x-swift-migration-status migrated date Wed, 02 Mar 2022 13:19:47 GMT x-content-type-options nosniff x-d2id 71b1c9f9-2e15-48b8-bd74-55285d20988e x-cdn a id 98794 content-length 14076 x-xss-protection 1; mode=block x-request-id 71b1c9f9-2e15-48b8-bd74-55285d20988e last-modified Tue, 25 Jun 2019 04:55:16 GMT server Tengine etag 0de1fd16bf20e0b68646e390d439ab42 content-type application/octet-stream access-control-allow-origin * x-timestamp 1561438515 cache-control public, max-age=31536000 accept-ranges bytes
GET H2	200	proximanova-regular.woff2 http2.mlstatic.com/ui/webfonts/v3.0.0/proxima-nova/	14 KB 14 KB	305ms 46ms	Font application/octet-stream	2.16.186.216 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://http2.mlstatic.com/ui/webfonts/v3.0.0/proxima-nova/proximanova-regular.woff2 Requested by Host: www.mercado-pago.duckdns.org URL: http://www.mercado-pago.duckdns.org/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.186.216 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-186-216.deploy.static.akamaitechnologies.com Software Tengine / Resource Hash 9411ab12b8dd65ce03ea7e1c62557fc2d1eaa1d5d1493609a14a2e29b8342918 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer http://www.mercado-pago.duckdns.org/ Origin http://www.mercado-pago.duckdns.org Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers x-object-meta-x-swift-migration-status migrated date Wed, 02 Mar 2022 13:19:47 GMT x-content-type-options nosniff x-d2id ce73384c-e6a9-47d2-a7ef-1dd2ef08b99f x-cdn a id 49473 content-length 14076 x-xss-protection 1; mode=block x-request-id ce73384c-e6a9-47d2-a7ef-1dd2ef08b99f last-modified Tue, 25 Jun 2019 04:55:17 GMT server Tengine etag 67ff311675dbd02ddb898f02af6fddaf content-type application/octet-stream access-control-allow-origin * x-timestamp 1561438516 cache-control public, max-age=31536000 accept-ranges bytes
GET H2	200	navigation.css http2.mlstatic.com/ui/navigation/5.18.1/mercadopago/	16 KB 3 KB	302ms 44ms	Stylesheet text/css	2.16.186.216 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://http2.mlstatic.com/ui/navigation/5.18.1/mercadopago/navigation.css Requested by Host: www.mercado-pago.duckdns.org URL: http://www.mercado-pago.duckdns.org/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.186.216 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-186-216.deploy.static.akamaitechnologies.com Software Tengine / Resource Hash 0af1f2602d577d04f97f45d04d0bf79ce237a10380eab0785c5254e26b73997a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer http://www.mercado-pago.duckdns.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 02 Mar 2022 13:19:47 GMT content-encoding br x-content-type-options nosniff x-d2id 4e80b266-a36c-46f3-b746-a770033b3c71 x-cdn a id 52532 x-envoy-upstream-service-time 32 content-length 3034 x-xss-protection 1; mode=block x-request-id 4e80b266-a36c-46f3-b746-a770033b3c71 referrer-policy no-referrer-when-downgrade last-modified Thu, 18 Nov 2021 19:34:44 GMT server Tengine vary Accept-Encoding content-type text/css access-control-allow-origin * x-timestamp 1637264083 cache-control public, max-age=31535697 timing-allow-origin * x-request-device-id 4e80b266-a36c-46f3-b746-a770033b3c71
GET H/1.1	200 OK	email.js Show response www.mercado-pago.duckdns.org/Assets/js/	953 B 854 B	205ms 205ms	Script application/javascript	35.198.47.2 GOOGLE-PRIVATE-CLOUD
General Check archive.org Show headers Download Go to Full URL http://www.mercado-pago.duckdns.org/Assets/js/email.js Requested by Host: www.mercado-pago.duckdns.org URL: http://www.mercado-pago.duckdns.org/ Protocol HTTP/1.1 Server 35.198.47.2 São Paulo, Brazil, ASN396982 (GOOGLE-PRIVATE-CLOUD, US), Reverse DNS 2.47.198.35.bc.googleusercontent.com Software Apache/2.4.41 (Ubuntu) / Resource Hash 9fdb9156c0a3d6ca6e0f819abc087c0238281e4c76644e9b7f5e0b419bf65aca Request headers Accept-Language de-DE,de;q=0.9 Referer http://www.mercado-pago.duckdns.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Wed, 02 Mar 2022 13:19:47 GMT Content-Encoding gzip Last-Modified Tue, 01 Mar 2022 17:41:22 GMT Server Apache/2.4.41 (Ubuntu) ETag "3b9-5d92bac6934d0-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 504
GET H2	200	964e5dd5562b8ea1121f.svg http2.mlstatic.com/frontend-assets/auth-login-frontend/	13 KB 6 KB	50ms 49ms	Image image/svg+xml	2.16.186.216 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://http2.mlstatic.com/frontend-assets/auth-login-frontend/964e5dd5562b8ea1121f.svg Requested by Host: www.mercado-pago.duckdns.org URL: http://www.mercado-pago.duckdns.org/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.186.216 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-186-216.deploy.static.akamaitechnologies.com Software Tengine / Resource Hash 139e169f61be6f59c8c74cb26cb429b4ac566783d22d2060010bbfad101f6b0b Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer http://www.mercado-pago.duckdns.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers strict-transport-security max-age=15552000; includeSubDomains content-encoding gzip x-content-type-options nosniff x-d2id 5a0d23ec-c3ac-4d01-8f5e-616855cdac63 x-permitted-cross-domain-policies none x-dns-prefetch-control on x-envoy-upstream-service-time 8 content-length 5960 x-xss-protection 1; mode=block x-request-id 5a0d23ec-c3ac-4d01-8f5e-616855cdac63 x-cdn a referrer-policy no-referrer-when-downgrade server Tengine etag "33d7-bU8ew0J1DDs6+sP87pdqQCZZfX8" expect-ct max-age=0 vary Accept-Encoding x-download-options noopen content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000, immutable accept-ch-lifetime 60 accept-ch device-memory, dpr, viewport-width, rtt, downlink, ect, save-data timing-allow-origin * date Wed, 02 Mar 2022 13:19:47 GMT x-request-device-id 5a0d23ec-c3ac-4d01-8f5e-616855cdac63
GET H2	200	bc3798435e48b9db0f87.svg http2.mlstatic.com/frontend-assets/auth-login-frontend/	777 B 1 KB	52ms 52ms	Image image/svg+xml	2.16.186.216 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://http2.mlstatic.com/frontend-assets/auth-login-frontend/bc3798435e48b9db0f87.svg Requested by Host: www.mercado-pago.duckdns.org URL: http://www.mercado-pago.duckdns.org/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.186.216 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-186-216.deploy.static.akamaitechnologies.com Software Tengine / Resource Hash fabcec498a4e1c7b20108d29b5e0097bd9a57b614f41a20013d0486ebb327cf9 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer http://www.mercado-pago.duckdns.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers strict-transport-security max-age=15552000; includeSubDomains x-content-type-options nosniff x-d2id ca215673-6b8e-43e4-8b3c-8e8bbf3ea8da x-permitted-cross-domain-policies none x-dns-prefetch-control on x-envoy-upstream-service-time 56 content-length 777 x-xss-protection 1; mode=block x-request-id ca215673-6b8e-43e4-8b3c-8e8bbf3ea8da x-cdn a referrer-policy no-referrer-when-downgrade server Tengine etag "309-vOR2E1DOdO1FBJiVsSN7Xoug8HU" x-download-options noopen expect-ct max-age=0 content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000, immutable accept-ch-lifetime 60 accept-ch device-memory, dpr, viewport-width, rtt, downlink, ect, save-data timing-allow-origin * date Wed, 02 Mar 2022 13:19:47 GMT x-request-device-id ca215673-6b8e-43e4-8b3c-8e8bbf3ea8da
GET H2	200	nr-1215.min.js Show response js-agent.newrelic.com/	36 KB 14 KB	121ms 19ms	Script application/javascript	151.101.130.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://js-agent.newrelic.com/nr-1215.min.js Requested by Host: www.mercado-pago.duckdns.org URL: http://www.mercado-pago.duckdns.org/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.130.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 18395fd1ef75de4f03f701f5a5020563aed55e1539b3200605053f2c924211bb Request headers Accept-Language de-DE,de;q=0.9 Referer http://www.mercado-pago.duckdns.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers x-amz-version-id mrZZlI3m.d3cabi4HqLBBkr4pQ2c77UF content-encoding gzip etag "615035bb6557b191e767e19087efabaf" x-amz-request-id 4M737C4C52KJMHNF x-cache HIT cross-origin-resource-policy cross-origin content-length 13666 x-amz-id-2 nfH3UMtgmUhQfzUFrk2J/eRrlW/VGa++ZZv17NQinrGn4LgjekPO9xCRG2TY0LjsSacwJiTH81A= x-served-by cache-hhn4041-HHN last-modified Mon, 24 Jan 2022 22:13:53 GMT server AmazonS3 x-timer S1646227188.699370,VS0,VE0 date Wed, 02 Mar 2022 13:19:47 GMT vary Accept-Encoding content-type application/javascript via 1.1 varnish cache-control public, max-age=7200, stale-if-error=604800 accept-ranges bytes x-cache-hits 16702
GET H2	200	backgr_logo.png www.mercadolivre.com/jms/mlb/lgz/sp/	74 B 680 B	320ms 147ms	Image image/png	18.66.248.57 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.mercadolivre.com/jms/mlb/lgz/sp/backgr_logo.png?profile=http://www.mercado-pago.duckdns.org/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.248.57 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-248-57.dus51.r.cloudfront.net Software Tengine / Resource Hash 01b58ddb2f86a768f91751b62f25395417f6cf526191a4aefc1ebe4f8beacdcb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer http://www.mercado-pago.duckdns.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 02 Mar 2022 13:19:47 GMT x-envoy-decorator-operation prod-web-scope.seginf-pixel.melifrontends.com x-content-type-options nosniff x-d2id 9354772a-a1ee-4031-847b-fdf9d199111f x-amz-cf-pop DUS51-P1 x-cache Miss from cloudfront x-envoy-upstream-service-time 4 content-length 74 x-xss-protection 1; mode=block x-request-id 9354772a-a1ee-4031-847b-fdf9d199111f referrer-policy no-referrer-when-downgrade server Tengine content-type image/png via 1.1 8d4901eb4989773bb579fc1597e54ea8.cloudfront.net (CloudFront) x-amz-cf-id nOLlSNwLOuUvrgp4g-58xRbdAJRedsfusE4PJgu58zR7lcTJSfUuGw== x-request-device-id 9354772a-a1ee-4031-847b-fdf9d199111f
GET H/1.1	200 OK	3009922991 Show response bam-cell.nr-data.net/1/	49 B 715 B	533ms 492ms	Script text/javascript	162.247.243.147 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://bam-cell.nr-data.net/1/3009922991?a=42549344&v=1215.1253ab8&to=bgRaYENYWBdWABdfXVdOe0FCTVkJGBUKU0UWFEtRQw%3D%3D&rst=1386&ck=1&ref=http://www.mercado-pago.duckdns.org/&ap=103.611701&be=841&fe=1256&dc=1255&tt=42369e4e12b1c3db&af=err,xhr,stn,ins&perf=%7B%22timing%22:%7B%22of%22:1646227186337,%22n%22:0,%22f%22:1,%22dn%22:2,%22dne%22:380,%22c%22:380,%22ce%22:604,%22rq%22:604,%22rp%22:815,%22rpe%22:1244,%22dl%22:818,%22di%22:1256,%22ds%22:1256,%22de%22:1256,%22dc%22:1256,%22l%22:1256,%22le%22:1257%7D,%22navigation%22:%7B%7D%7D&fp=1188&fcp=1188&jsonp=NREUM.setToken Requested by Host: js-agent.newrelic.com URL: https://js-agent.newrelic.com/nr-1215.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.247.243.147 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82 Request headers Accept-Language de-DE,de;q=0.9 Referer http://www.mercado-pago.duckdns.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Wed, 02 Mar 2022 13:19:48 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Server cloudflare Expect-CT max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Vary Accept-Encoding access-control-allow-methods GET, POST, PUT, HEAD, OPTIONS Content-Type text/javascript Access-Control-Allow-Origin * Transfer-Encoding chunked Cross-Origin-Resource-Policy cross-origin Connection keep-alive access-control-allow-credentials true CF-Ray 6e5a6d138e7a996c-FRA

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Mercado Pago (Consumer)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored object| NREUM object| newrelic function| __nr_require function| TransformInvalid object| _0x2dbd

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.nr-data.net/	1969-12-31 23:59:59	Name: JSESSIONID Value: d46e93c071b97909

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: http://www.mercado-pago.duckdns.org/(Line 1339) Message: <link rel=preload> has an invalid `href` value

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bam-cell.nr-data.net
http2.mlstatic.com
js-agent.newrelic.com
www.mercado-pago.duckdns.org
www.mercadolivre.com
151.101.130.137
162.247.243.147
18.66.248.57
2.16.186.216
35.198.47.2
01b58ddb2f86a768f91751b62f25395417f6cf526191a4aefc1ebe4f8beacdcb
0af1f2602d577d04f97f45d04d0bf79ce237a10380eab0785c5254e26b73997a
139e169f61be6f59c8c74cb26cb429b4ac566783d22d2060010bbfad101f6b0b
18395fd1ef75de4f03f701f5a5020563aed55e1539b3200605053f2c924211bb
5adeecfee91f5032d36cfc7d1acda895ce1280111ecb07d82cf1d0fd8e9505e6
9411ab12b8dd65ce03ea7e1c62557fc2d1eaa1d5d1493609a14a2e29b8342918
9bb769c5a9f25f8d52e9ba56881641ec0ca019da478cf2910457fdbea01fcd14
9fdb9156c0a3d6ca6e0f819abc087c0238281e4c76644e9b7f5e0b419bf65aca
dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82
fabcec498a4e1c7b20108d29b5e0097bd9a57b614f41a20013d0486ebb327cf9