URL: https://clientes.mara.com.br/
Submission Tags: @ecarlesi possiblethreat phishing Search All
Submission: On October 24 via api from IT — Scanned from IT

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 7 HTTP transactions. The main IP is 99.86.4.64, located in United States and belongs to AMAZON-02, US. The main domain is clientes.mara.com.br.
TLS certificate: Issued by Amazon RSA 2048 M02 on October 24th 2024. Valid for: a year.
This is the only time clientes.mara.com.br was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 99.86.4.64 16509 (AMAZON-02)
1 104.18.2.49 13335 (CLOUDFLAR...)
1 18.66.102.118 16509 (AMAZON-02)
2 54.160.25.132 14618 (AMAZON-AES)
7 4
Apex Domain
Subdomains
Transfer
3 mara.com.br
clientes.mara.com.br
120 KB
2 es.io
3b89d874858b402badc65d45cd699807.apm.us-east-1.aws.cloud.es.io
40 B
1 imageboss.me
img.imageboss.me — Cisco Umbrella Rank: 294539
1 KB
1 pagseguro.com.br
assets.pagseguro.com.br — Cisco Umbrella Rank: 365512
33 KB
7 4
Domain Requested by
3 clientes.mara.com.br clientes.mara.com.br
2 3b89d874858b402badc65d45cd699807.apm.us-east-1.aws.cloud.es.io clientes.mara.com.br
1 img.imageboss.me
1 assets.pagseguro.com.br clientes.mara.com.br
7 4

This site contains no links.

Subject Issuer Validity Valid
clientes.mara.com.br
Amazon RSA 2048 M02
2024-10-24 -
2025-11-22
a year crt.sh
pagseguro.com.br
WE1
2024-09-01 -
2024-11-30
3 months crt.sh
imageboss.io
Amazon RSA 2048 M02
2024-02-08 -
2025-03-08
a year crt.sh
*.us-east-1.aws.elastic-cloud.com
R11
2024-10-07 -
2025-01-05
3 months crt.sh

This page contains 1 frames:

Primary Page: https://clientes.mara.com.br/
Frame ID: BDF723E5B8426A5F0036F9C1812ABAF8
Requests: 6 HTTP requests in this frame

Screenshot

Page Title

Mara - Pagamento de Pedido

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+\sdata-v(?:ue)?-

Page Statistics

7
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

154 kB
Transfer

483 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
clientes.mara.com.br/
1 KB
896 B
Document
General
Full URL
https://clientes.mara.com.br/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.4.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-4-64.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
39201978ced812819945ba455cd0dd16c5680d348118588709c076f6466bbd7d

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
max-age=0, no-cache, no-store, must-revalidate
content-encoding
br
content-type
text/html
date
Thu, 24 Oct 2024 08:18:04 GMT
etag
W/"3dad12e38a5be6966720dd8a18973acc"
last-modified
Mon, 14 Oct 2024 18:27:38 GMT
server
AmazonS3
vary
Accept-Encoding
via
1.1 c05282a87474a55ae2a8dd2aa77d1232.cloudfront.net (CloudFront)
x-amz-cf-id
sHly1HYBIp6gWz4qZGLIMW2iDFEkWNrSMUN5rCanPWeFsI54P2uIuQ==
x-amz-cf-pop
FRA6-C1
x-cache
Miss from cloudfront
index-f47c5dab.js
clientes.mara.com.br/assets/
358 KB
113 KB
Script
General
Full URL
https://clientes.mara.com.br/assets/index-f47c5dab.js
Requested by
Host: clientes.mara.com.br
URL: https://clientes.mara.com.br/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.4.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-4-64.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
2e689d2d723905428cb80125ae85fa2b547fe724254f78c2081c9d78915f3641

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://clientes.mara.com.br
Referer
https://clientes.mara.com.br/

Response headers

cache-control
max-age=604800, public
content-encoding
br
etag
W/"5b6620caec3942a52b615da38924aed0"
via
1.1 c05282a87474a55ae2a8dd2aa77d1232.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Miss from cloudfront
x-amz-cf-id
DNJoPsFzc2jDdco8QRJ_LHllqaL-F7GSOK4RuK1h6jQMsUFVcsjCcA==
date
Thu, 24 Oct 2024 08:18:04 GMT
content-type
text/javascript
last-modified
Mon, 14 Oct 2024 18:27:37 GMT
server
AmazonS3
x-amz-cf-pop
FRA6-C1
vary
Accept-Encoding
index-8b945d79.css
clientes.mara.com.br/assets/
28 KB
6 KB
Stylesheet
General
Full URL
https://clientes.mara.com.br/assets/index-8b945d79.css
Requested by
Host: clientes.mara.com.br
URL: https://clientes.mara.com.br/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.4.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-4-64.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
8b945d7953d40e6fec574147dc2f61ab4685d9c996f507d54d259165e943dd54

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://clientes.mara.com.br/

Response headers

cache-control
max-age=604800, public
content-encoding
br
etag
W/"99df7408a72cc21922f499608c88243f"
via
1.1 c05282a87474a55ae2a8dd2aa77d1232.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Miss from cloudfront
x-amz-cf-id
-Sq72fYrm06_IfvlqGTjD74bNgdlsV4UiaF--WteQifuBZdL4VN-SA==
date
Thu, 24 Oct 2024 08:18:04 GMT
content-type
text/css
last-modified
Mon, 14 Oct 2024 18:27:37 GMT
server
AmazonS3
x-amz-cf-pop
FRA6-C1
vary
Accept-Encoding
pagseguro.min.js
assets.pagseguro.com.br/checkout-sdk-js/rc/dist/browser/
94 KB
33 KB
Script
General
Full URL
https://assets.pagseguro.com.br/checkout-sdk-js/rc/dist/browser/pagseguro.min.js
Requested by
Host: clientes.mara.com.br
URL: https://clientes.mara.com.br/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
104.18.2.49 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9d4cef2d63e9f7d7603ee606eaa2b2b1dfe35d446600628c6d5c020163d34594
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://clientes.mara.com.br/

Response headers

Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
x-amz-version-id
CCTxQ_T5z.eCUhxpnGmalPF5r.cxEqAY
ETag
W/"3ef175ec8cacf1627f52aecb58438140"
Age
39
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
n2tI7GMcRSCanScHD-iUcW4id3Lt2aI0gaEspUmiOZkTVI5IveqKYw==
Date
Thu, 24 Oct 2024 08:18:04 GMT
Content-Type
application/javascript
Last-Modified
Thu, 22 Aug 2024 04:21:44 GMT
Vary
Accept-Encoding,Origin
Transfer-Encoding
chunked
Strict-Transport-Security
max-age=15552000; includeSubDomains
x-amz-replication-status
COMPLETED
Cache-Control
public,max-age=300
Connection
keep-alive
Via
1.1 2fb101a75d62357647d00a936fb26d02.cloudfront.net (CloudFront)
CF-RAY
8d7888b7ed230e9f-MXP
X-Amz-Cf-Pop
MXP64-C3
Server
cloudflare
x-amz-server-side-encryption
AES256
3a19e771-cfd1-4212-a3e1-1b5d0d21d80c
img.imageboss.me/mara/cdn/format:auto/assets/
953 B
1 KB
Other
General
Full URL
https://img.imageboss.me/mara/cdn/format:auto/assets/3a19e771-cfd1-4212-a3e1-1b5d0d21d80c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.102.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-102-118.fra56.r.cloudfront.net
Software
/
Resource Hash
41d3acbe69fd97c76861cd082f1fe75fc53991108ce31db0ec9b217b555aed1d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://clientes.mara.com.br/

Response headers

link
<https://directus.mara.com.br/assets/3a19e771-cfd1-4212-a3e1-1b5d0d21d80c>; rel="canonical"
cache-control
public, max-age=31536000, immutable
x-amz-cf-id
v29qyqOei7z6ym0b_EJEu-y8asxzobDFJqtu12mj90FHkznpF6s3mA==
age
12458176
via
1.1 993c0866e705e48daa4fed5e30627712.cloudfront.net (CloudFront)
access-control-allow-origin
*
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400
date
Sun, 02 Jun 2024 03:41:49 GMT
content-type
image/avif
vary
Accept
x-amz-cf-pop
FRA56-P2
events
3b89d874858b402badc65d45cd699807.apm.us-east-1.aws.cloud.es.io/intake/v2/rum/
0
40 B
Fetch
General
Full URL
https://3b89d874858b402badc65d45cd699807.apm.us-east-1.aws.cloud.es.io/intake/v2/rum/events
Requested by
Host: clientes.mara.com.br
URL: https://clientes.mara.com.br/assets/index-f47c5dab.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.160.25.132 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-160-25-132.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://clientes.mara.com.br/
Content-Encoding
gzip
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type
application/x-ndjson

Response headers

access-control-allow-origin
https://clientes.mara.com.br
x-found-handling-instance
instance-0000000000
content-length
0
x-found-handling-cluster
3b89d874858b402badc65d45cd699807
date
Thu, 24 Oct 2024 08:18:06 GMT
x-cloud-request-id
gvX42h6qSF2OV_wSzMhnVg
x-content-type-options
nosniff
events
3b89d874858b402badc65d45cd699807.apm.us-east-1.aws.cloud.es.io/intake/v2/rum/
0
0
Preflight
General
Full URL
https://3b89d874858b402badc65d45cd699807.apm.us-east-1.aws.cloud.es.io/intake/v2/rum/events
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.160.25.132 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-160-25-132.compute-1.amazonaws.com
Software
/
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
*/*
Access-Control-Request-Headers
content-encoding,content-type
Access-Control-Request-Method
POST
Origin
https://clientes.mara.com.br
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
Content-Type, Content-Encoding, Accept
access-control-allow-methods
POST, OPTIONS
access-control-allow-origin
https://clientes.mara.com.br
access-control-expose-headers
Etag
access-control-max-age
3600
content-length
0
date
Thu, 24 Oct 2024 08:18:06 GMT
vary
Origin
x-cloud-request-id
_hr1ryavTseRMLpezoxqCQ
x-content-type-options
nosniff
x-found-handling-cluster
3b89d874858b402badc65d45cd699807
x-found-handling-instance
instance-0000000000

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| PagSeguro function| JSEncrypt object| __VUE_INSTANCE_SETTERS__ object| __VUE_SSR_SETTERS__ object| elasticApm boolean| __VUE__

1 Cookies

Domain/Path Name / Value
.pagseguro.com.br/ Name: __cf_bm
Value: bySv9oqdO8rKTaoHqgKfNf8Wk0PooTY3Yl.UGAqFIZ4-1729757884-1.0.1.1-BaD1q3ikYsuaOE5T3yAe.gBJKvV2mAeBUjj3h0XaeiLIy7mzCSxe.P8Wl8_jEPlRZ0qMQL8mtDn5ctpkL03Avg