www.cnea.gub.uy - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 6 HTTP transactions. The main IP is 190.0.140.242, located in Uruguay and belongs to Administracion Nacional de Telecomunicaciones, UY. The main domain is www.cnea.gub.uy.
TLS certificate: Issued by R3 on April 10th 2022. Valid for: 3 months.

This is the only time www.cnea.gub.uy was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Mercado Pago (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
5	190.0.140.242 190.0.140.242	6057 (Administr...) (Administracion Nacional de Telecomunicaciones)
1	2.16.22.224 2.16.22.224	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
6	2

5 190.0.140.242 (Uruguay)

ASN6057 (Administracion Nacional de Telecomunicaciones, UY)

www.cnea.gub.uy	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.16.22.224 (Milan, Italy)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-22-224.deploy.static.akamaitechnologies.com

http2.mlstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	cnea.gub.uy www.cnea.gub.uy	111 KB
1	mlstatic.com http2.mlstatic.com — Cisco Umbrella Rank: 20450	14 KB
6	2

	Domain	Requested by
5	www.cnea.gub.uy	www.cnea.gub.uy
1	http2.mlstatic.com	www.cnea.gub.uy
6	2

This site contains no links.

Subject Issuer	Validity	Valid
www.cnea.gub.uy R3	`2022-04-10` - `2022-07-09`	3 months	crt.sh
*.mlstatic.com DigiCert SHA2 Secure Server CA	`2021-07-25` - `2022-07-27`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.cnea.gub.uy/assets/imagenes/usuarios/acreditacion/documentos/mercadopago.com/
Frame ID: 010ED01159DF9AABB47AED344DB73C32
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

¡Hola! Para seguir, ingresa tu e-mail o usuario

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

126 kB
Transfer

124 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
www.cnea.gub.uy/assets/imagenes/usuarios/acreditacion/documentos/mercadopago.com/ 1012 B
1 KB 3700ms
260ms Document
text/html 190.0.140.242
Administracion Na...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cnea.gub.uy/assets/imagenes/usuarios/acreditacion/documentos/mercadopago.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 190.0.140.242 , Uruguay, ASN6057 (Administracion Nacional de Telecomunicaciones, UY),
Reverse DNS
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips / PHP/5.6.40
Resource Hash: ca2393a3008c79a7b78d579ec063a9614381e2e383ed65cc81b52e215f8a8ed4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Wed, 20 Apr 2022 13:44:41 GMT
Keep-Alive: timeout=5, max=100
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips
Transfer-Encoding: chunked
X-Powered-By: PHP/5.6.40

GET
H/1.1 200
OK styles.css
www.cnea.gub.uy/assets/imagenes/usuarios/acreditacion/documentos/mercadopago.com/ 12 KB
12 KB 241ms
240ms Stylesheet
text/css 190.0.140.242
Administracion Na...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cnea.gub.uy/assets/imagenes/usuarios/acreditacion/documentos/mercadopago.com/styles.css
Requested by: Host: www.cnea.gub.uy
URL: https://www.cnea.gub.uy/assets/imagenes/usuarios/acreditacion/documentos/mercadopago.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 190.0.140.242 , Uruguay, ASN6057 (Administracion Nacional de Telecomunicaciones, UY),
Reverse DNS
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips /
Resource Hash: e91260de2a524c16f71133f9da2ad27fa81f4317d235d8744aecbb90d7d24802

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cnea.gub.uy/assets/imagenes/usuarios/acreditacion/documentos/mercadopago.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Wed, 20 Apr 2022 13:44:41 GMT
Last-Modified: Thu, 10 Mar 2022 16:13:02 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips
ETag: "3089-5d9df7d1398c8"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 12425

GET
H/1.1 200
OK logoIndex.png
www.cnea.gub.uy/assets/imagenes/usuarios/acreditacion/documentos/mercadopago.com/ 4 KB
5 KB 240ms
240ms Image
image/png 190.0.140.242
Administracion Na...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cnea.gub.uy/assets/imagenes/usuarios/acreditacion/documentos/mercadopago.com/logoIndex.png
Requested by: Host: www.cnea.gub.uy
URL: https://www.cnea.gub.uy/assets/imagenes/usuarios/acreditacion/documentos/mercadopago.com/styles.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 190.0.140.242 , Uruguay, ASN6057 (Administracion Nacional de Telecomunicaciones, UY),
Reverse DNS
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips /
Resource Hash: c9df19904697b88aa311b9e1ebc69c23dbfb14684406281ae1c8ca0513f97278

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cnea.gub.uy/assets/imagenes/usuarios/acreditacion/documentos/mercadopago.com/styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Wed, 20 Apr 2022 13:44:41 GMT
Last-Modified: Thu, 10 Mar 2022 16:13:02 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips
ETag: "11d4-5d9df7d124cc0"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 4564

GET
H/1.1 404
Not Found help.png
www.cnea.gub.uy/assets/imagenes/usuarios/acreditacion/documentos/mercadopago.com/ 271 B
271 B 241ms
240ms Image
text/html 190.0.140.242
Administracion Na...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cnea.gub.uy/assets/imagenes/usuarios/acreditacion/documentos/mercadopago.com/help.png
Requested by: Host: www.cnea.gub.uy
URL: https://www.cnea.gub.uy/assets/imagenes/usuarios/acreditacion/documentos/mercadopago.com/styles.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 190.0.140.242 , Uruguay, ASN6057 (Administracion Nacional de Telecomunicaciones, UY),
Reverse DNS
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips /
Resource Hash: 65e6da40403074d24de6eefbfbc31e41bc90075ad275b4cf2c770c77d729ba80

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cnea.gub.uy/assets/imagenes/usuarios/acreditacion/documentos/mercadopago.com/styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Wed, 20 Apr 2022 13:44:41 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 271
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 proxima-nova-400.woff2
http2.mlstatic.com/ui/webfonts/v4.0.0/proxima-nova/ 14 KB
14 KB 232ms
27ms Font
application/octet-stream 2.16.22.224
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://http2.mlstatic.com/ui/webfonts/v4.0.0/proxima-nova/proxima-nova-400.woff2

Requested by

Host: www.cnea.gub.uy
URL: https://www.cnea.gub.uy/assets/imagenes/usuarios/acreditacion/documentos/mercadopago.com/styles.css

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

2.16.22.224 Milan, Italy, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-16-22-224.deploy.static.akamaitechnologies.com

Software

Tengine /

Resource Hash

9411ab12b8dd65ce03ea7e1c62557fc2d1eaa1d5d1493609a14a2e29b8342918

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.cnea.gub.uy/
Origin: https://www.cnea.gub.uy
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-object-meta-x-swift-migration-status: migrated
date: Wed, 20 Apr 2022 13:44:49 GMT
x-content-type-options: nosniff
x-d2id: f2eac4cd-41b0-433c-ace5-99cedca105f3
x-cdn: a
id: 74314
content-length: 14076
x-xss-protection: 1; mode=block
x-request-id: f2eac4cd-41b0-433c-ace5-99cedca105f3
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 25 Jun 2019 04:51:53 GMT
server: Tengine
etag: 67ff311675dbd02ddb898f02af6fddaf
content-type: application/octet-stream
access-control-allow-origin: *
x-timestamp: 1561438312
cache-control: public, max-age=31536000
accept-ranges: bytes

GET
H/1.1 200
OK ProximaNova-Regular.otf
www.cnea.gub.uy/assets/imagenes/usuarios/acreditacion/documentos/mercadopago.com/ 92 KB
93 KB 475ms
241ms Font
application/vnd.oasis.opendocument.formula-template 190.0.140.242
Administracion Na...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cnea.gub.uy/assets/imagenes/usuarios/acreditacion/documentos/mercadopago.com/ProximaNova-Regular.otf
Requested by: Host: www.cnea.gub.uy
URL: https://www.cnea.gub.uy/assets/imagenes/usuarios/acreditacion/documentos/mercadopago.com/styles.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 190.0.140.242 , Uruguay, ASN6057 (Administracion Nacional de Telecomunicaciones, UY),
Reverse DNS
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips /
Resource Hash: 36b59421bdc34fd9869a7541c47d5f157ff19eb183032efff759c4d5be5d9cae

Request headers

Referer: https://www.cnea.gub.uy/assets/imagenes/usuarios/acreditacion/documentos/mercadopago.com/styles.css
Origin: https://www.cnea.gub.uy
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Wed, 20 Apr 2022 13:44:41 GMT
Last-Modified: Thu, 10 Mar 2022 16:13:02 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips
ETag: "171cc-5d9df7d1250a8"
Content-Type: application/vnd.oasis.opendocument.formula-template
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 94668

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Mercado Pago (Consumer)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.cnea.gub.uy/assets/imagenes/usuarios/acreditacion/documentos/mercadopago.com/help.png Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

http2.mlstatic.com
www.cnea.gub.uy
190.0.140.242
2.16.22.224
36b59421bdc34fd9869a7541c47d5f157ff19eb183032efff759c4d5be5d9cae
65e6da40403074d24de6eefbfbc31e41bc90075ad275b4cf2c770c77d729ba80
9411ab12b8dd65ce03ea7e1c62557fc2d1eaa1d5d1493609a14a2e29b8342918
c9df19904697b88aa311b9e1ebc69c23dbfb14684406281ae1c8ca0513f97278
ca2393a3008c79a7b78d579ec063a9614381e2e383ed65cc81b52e215f8a8ed4
e91260de2a524c16f71133f9da2ad27fa81f4317d235d8744aecbb90d7d24802

www.cnea.gub.uy Open in urlscan Pro 190.0.140.242 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

126 kBTransfer

124 kBSize

0 Cookies

0 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

www.cnea.gub.uy Open in urlscan Pro
190.0.140.242 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

126 kB
Transfer

124 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!