solucionar-pagommensual.com Open in urlscan Pro
104.21.76.182 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://solucionar-pagommensual.com/
Submission Tags: @ecarlesi threat #phishing #ml_ayuda Search All
Submission: On August 06 via api (August 6th 2023, 7:34:45 am UTC) from AU — Scanned from AU

Summary HTTP 9 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 9 HTTP transactions. The main IP is 104.21.76.182, located in and belongs to CLOUDFLARENET, US. The main domain is solucionar-pagommensual.com.
TLS certificate: Issued by E1 on August 5th 2023. Valid for: 3 months.

This is the only time solucionar-pagommensual.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Mercado Pago (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
3	104.21.76.182 104.21.76.182	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	142.251.12.95 142.251.12.95	15169 (GOOGLE) (GOOGLE)
4	42.99.140.219 42.99.140.219	4637 (ASN-TELST...) (ASN-TELSTRA-GLOBAL Telstra Global)
1	142.251.12.103 142.251.12.103	15169 (GOOGLE) (GOOGLE)
9	4

3 104.21.76.182 (None, )

ASN13335 (CLOUDFLARENET, US)

solucionar-pagommensual.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.12.95 (United States)

ASN15169 (GOOGLE, US)
PTR: se-in-f95.1e100.net

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 42.99.140.219 (Japan)

ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK)
PTR: ip-42-99-140-219.pacnet.net

http2.mlstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.12.103 (United States)

ASN15169 (GOOGLE, US)
PTR: se-in-f103.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	mlstatic.com http2.mlstatic.com — Cisco Umbrella Rank: 24611	36 KB
3	solucionar-pagommensual.com solucionar-pagommensual.com	14 KB
1	google.com www.google.com — Cisco Umbrella Rank: 3	925 B
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 406	30 KB
9	4

	Domain	Requested by
4	http2.mlstatic.com	solucionar-pagommensual.com
3	solucionar-pagommensual.com	solucionar-pagommensual.com
1	www.google.com	solucionar-pagommensual.com
1	ajax.googleapis.com	solucionar-pagommensual.com
9	4

This site contains links to these domains. Also see Links.

Domain
policies.google.com

Subject Issuer	Validity	Valid
solucionar-pagommensual.com E1	`2023-08-05` - `2023-11-03`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
*.mlstatic.com DigiCert TLS RSA SHA256 2020 CA1	`2023-04-08` - `2024-04-10`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://solucionar-pagommensual.com/
Frame ID: 395CB17DF9DD93AA8487E3EC9E2A59DE
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

(1) Alerta importante!

Detected technologies

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+data-react

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

googleapis\.com/.+webfont

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

<link[^>]+recaptcha

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

81 kB
Transfer

214 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://policies.google.com/privacy?hl=es-AR
Title: Privacidad

Search URL Search Domain Scan URL

URL: https://policies.google.com/terms?hl=es-AR
Title: Condiciones

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
solucionar-pagommensual.com/ 8 KB
2 KB 1153ms
756ms Document
text/html 104.21.76.182
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://solucionar-pagommensual.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.76.182 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 48439d1952f13e8e74afab7ac1f6fe1b871b1572c87c51b679d0c94ccca6a8f4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7f25993fae4aa980-SYD
content-encoding: br
content-type: text/html
date: Sun, 06 Aug 2023 07:34:39 GMT
last-modified: Mon, 20 Jun 2022 05:54:31 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=es133jifsEKGDCUTeT8RL350cjSloYLO9rHPSI0kcc7dgJTxXAtQ088KckfFGQBAvACAFr1z286mNC39wKFsnl6NBtCc6N5S5KxBezN70ehNdEAQVpifpAYbsWUyemihEjYSfTkwiJITpuXgGb4%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.2.1/ 85 KB
30 KB 867ms
187ms Script
text/javascript 142.251.12.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js

Requested by

Host: solucionar-pagommensual.com
URL: https://solucionar-pagommensual.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f95.1e100.net

Software

sffe /

Resource Hash

87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://solucionar-pagommensual.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 07:13:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 87662
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30306
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 04 Aug 2024 07:13:38 GMT

GET
H2 200 proximanova-light.woff2
http2.mlstatic.com/ui/webfonts/v3.0.0/proxima-nova/ 14 KB
14 KB 707ms
199ms Font
font/woff2 42.99.140.219
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to

Full URL

https://http2.mlstatic.com/ui/webfonts/v3.0.0/proxima-nova/proximanova-light.woff2

Requested by

Host: solucionar-pagommensual.com
URL: https://solucionar-pagommensual.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

42.99.140.219 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),

Reverse DNS

ip-42-99-140-219.pacnet.net

Software

Tengine /

Resource Hash

9bb769c5a9f25f8d52e9ba56881641ec0ca019da478cf2910457fdbea01fcd14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://solucionar-pagommensual.com/
Origin: https://solucionar-pagommensual.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-amz-version-id: C4CTuYdIvDB_0NcYDhbmfHFUFBfVxB.Q
content-encoding: gzip
x-content-type-options: nosniff
x-d2id: 7d6118ae-af68-42b4-a4b9-926328d02bfd
x-cdn: a
date: Sun, 06 Aug 2023 07:34:40 GMT
x-amz-request-id: KATQ8DHCA8D5MJBZ
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
content-length: 14099
x-xss-protection: 1; mode=block
x-amz-id-2: 5xtVYX3OetQmvInKy8sAOX3HMwoblUSEsqW1VFSQ9A9z9seHkKXuSGTSOKltq2iGwQ3sYQ3W+L0=
x-request-id: 7d6118ae-af68-42b4-a4b9-926328d02bfd
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 07 Jun 2022 03:26:46 GMT
server: Tengine
etag: "0de1fd16bf20e0b68646e390d439ab42"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *
x-request-device-id: 7d6118ae-af68-42b4-a4b9-926328d02bfd

GET
H2 200 proximanova-regular.woff2
http2.mlstatic.com/ui/webfonts/v3.0.0/proxima-nova/ 14 KB
14 KB 722ms
215ms Font
font/woff2 42.99.140.219
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to

Full URL

https://http2.mlstatic.com/ui/webfonts/v3.0.0/proxima-nova/proximanova-regular.woff2

Requested by

Host: solucionar-pagommensual.com
URL: https://solucionar-pagommensual.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

42.99.140.219 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),

Reverse DNS

ip-42-99-140-219.pacnet.net

Software

Tengine /

Resource Hash

9411ab12b8dd65ce03ea7e1c62557fc2d1eaa1d5d1493609a14a2e29b8342918

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://solucionar-pagommensual.com/
Origin: https://solucionar-pagommensual.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-amz-version-id: MocYTiXX0FcyQ3NLXQ4zZuxDhFDOReik
content-encoding: gzip
x-content-type-options: nosniff
x-d2id: 7f4d5d2c-f3fe-4337-abf5-427e2882abaf
x-cdn: a
date: Sun, 06 Aug 2023 07:34:40 GMT
x-amz-request-id: KATGREAXPFMYQNH3
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
content-length: 14099
x-xss-protection: 1; mode=block
x-amz-id-2: sVUBLZmEQQ4gkRs5fTNMknf6BvpYZvr1DhgwA9wwI/3GQuz6KjqTdx6Yemm3WxuaNXprErGb0Rc=
x-request-id: 7f4d5d2c-f3fe-4337-abf5-427e2882abaf
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 07 Jun 2022 03:26:49 GMT
server: Tengine
etag: "67ff311675dbd02ddb898f02af6fddaf"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *
x-request-device-id: 7f4d5d2c-f3fe-4337-abf5-427e2882abaf

GET
H2 200 enterprise.js Show response
www.google.com/recaptcha/ 1000 B
925 B 870ms
194ms Script
text/javascript 142.251.12.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise.js?onload=onloadCallback&render=6LelVV4UAAAAADm4qkzt85y1Qh_n-JeoqwYIfX9u&hl=pt-BR

Requested by

Host: solucionar-pagommensual.com
URL: https://solucionar-pagommensual.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.103 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f103.1e100.net

Software

GSE /

Resource Hash

12500ae3773e6157e50b24a2809c53f603780f80b121c9f285810a5ad8175e54

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://solucionar-pagommensual.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sun, 06 Aug 2023 07:34:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 605
x-xss-protection: 1; mode=block
expires: Sun, 06 Aug 2023 07:34:40 GMT

GET
H2 200 navigation.css
solucionar-pagommensual.com/Ol%C3%A1!%20Digite%20o%20seu%20e-mail%20ou%20usu%C3%A1rio_files/ 20 KB
4 KB 1073ms
1072ms Stylesheet
text/css 104.21.76.182
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://solucionar-pagommensual.com/Ol%C3%A1!%20Digite%20o%20seu%20e-mail%20ou%20usu%C3%A1rio_files/navigation.css
Requested by: Host: solucionar-pagommensual.com
URL: https://solucionar-pagommensual.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.76.182 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a0d9a1de3d68002dc3c6cf31744b28d2ab5816f0c6e328c077971138f6583869

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://solucionar-pagommensual.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sun, 06 Aug 2023 07:34:41 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 24 Nov 2020 03:26:56 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"5171-5b4d1e1ffd60e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mM%2FNpdWZydisfcgbQtgs8tbZJx5ByQ4R%2Bu4J9qZpxkcaanM89GdKe767QXEZ2tm4DAOsb953tfKx0Bnl3oXEv3Q4Tv8w9XtOM40d7%2BU3pWZ8B8O%2FDUPLLimvKo%2BDAIZ5I3NeBHtSvRme6G6GHTg%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 7f2599447d67a980-SYD
alt-svc: h3=":443"; ma=86400

GET
H2 200 style_mp.css
solucionar-pagommensual.com/Ol%C3%A1!%20Digite%20o%20seu%20e-mail%20ou%20usu%C3%A1rio_files/ 59 KB
7 KB 1402ms
1401ms Stylesheet
text/css 104.21.76.182
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://solucionar-pagommensual.com/Ol%C3%A1!%20Digite%20o%20seu%20e-mail%20ou%20usu%C3%A1rio_files/style_mp.css
Requested by: Host: solucionar-pagommensual.com
URL: https://solucionar-pagommensual.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.76.182 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6c50b3224ddbd7ddb1c188286e8c9683809a83220eb6483a63fd6bbf11b05fed

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://solucionar-pagommensual.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sun, 06 Aug 2023 07:34:41 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 24 Nov 2020 03:26:56 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"ed8b-5b4d1e1ffe993"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sZpO%2BejE%2F4PHjl3jH0OuTcunDFzVeA6FmtZ5Wj3dOciSaKMRdIzSmHF7Q%2FXtNPnLB08CXUGiJ%2Bvnl6Zo83GW3N5q1pVHmcf4rcKpqcSHEEGNyh6ojNWd7KQ5UWb0FzU4sExHb9kzFU%2Bj8v%2Fqqqw%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 7f2599447d6aa980-SYD
alt-svc: h3=":443"; ma=86400

GET
H2 200 8006e27c2eb6345dc39a8c7736197fcd.svg
http2.mlstatic.com/frontend-assets/auth-login-frontend/ 12 KB
6 KB 558ms
186ms Image
image/svg+xml 42.99.140.219
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://http2.mlstatic.com/frontend-assets/auth-login-frontend/8006e27c2eb6345dc39a8c7736197fcd.svg

Requested by

Host: solucionar-pagommensual.com
URL: https://solucionar-pagommensual.com/Ol%C3%A1!%20Digite%20o%20seu%20e-mail%20ou%20usu%C3%A1rio_files/style_mp.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

42.99.140.219 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),

Reverse DNS

ip-42-99-140-219.pacnet.net

Software

Tengine /

Resource Hash

4df8b6ba3ef52fd0fd697f6906ba6ec3af4876a4b660c608d6f266727dc147aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://solucionar-pagommensual.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
x-d2id: a817b25b-7f3c-47cf-9a42-a97433efa666
x-permitted-cross-domain-policies: none
date: Sun, 06 Aug 2023 07:34:41 GMT
x-cdn: a
x-dns-prefetch-control: on
x-envoy-upstream-service-time: 124
content-length: 5735
x-xss-protection: 1; mode=block
x-request-id: a817b25b-7f3c-47cf-9a42-a97433efa666
referrer-policy: no-referrer-when-downgrade
server: Tengine
accept-ch: device-memory, dpr, viewport-width, rtt, downlink, ect, save-data
etag: "3181-UU8uUCOxL3IA+PjfeMdpHJjAOGM"
x-download-options: noopen
expect-ct: max-age=0
accept-ch-lifetime: 60
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
vary: Accept-Encoding
timing-allow-origin: *
x-request-device-id: a817b25b-7f3c-47cf-9a42-a97433efa666

GET
H2 200 9f137a27271b5e6fc3e2e1d9cb7a8783.svg
http2.mlstatic.com/frontend-assets/auth-login-frontend/ 757 B
1 KB 565ms
193ms Image
image/svg+xml 42.99.140.219
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://http2.mlstatic.com/frontend-assets/auth-login-frontend/9f137a27271b5e6fc3e2e1d9cb7a8783.svg

Requested by

Host: solucionar-pagommensual.com
URL: https://solucionar-pagommensual.com/Ol%C3%A1!%20Digite%20o%20seu%20e-mail%20ou%20usu%C3%A1rio_files/style_mp.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

42.99.140.219 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),

Reverse DNS

ip-42-99-140-219.pacnet.net

Software

Tengine /

Resource Hash

7aa9f61b090bbb746a4c687c1f94a65d8a93f43d42596e31cc9ae88d9982afbe

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://solucionar-pagommensual.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
date: Sun, 06 Aug 2023 07:34:41 GMT
x-content-type-options: nosniff
x-d2id: c37568ee-a830-468c-bca4-44099b2d35e5
x-permitted-cross-domain-policies: none
x-cdn: a
x-dns-prefetch-control: on
x-envoy-upstream-service-time: 70
alt-svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
content-length: 757
x-xss-protection: 1; mode=block
x-request-id: c37568ee-a830-468c-bca4-44099b2d35e5
referrer-policy: no-referrer-when-downgrade
server: Tengine
accept-ch: device-memory, dpr, viewport-width, rtt, downlink, ect, save-data
etag: "2f5-G9WJF/VY/AYsNEfgNQ/CmXYDh1s"
expect-ct: max-age=0
x-download-options: noopen
accept-ch-lifetime: 60
content-type: image/svg+xml; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
x-request-device-id: c37568ee-a830-468c-bca4-44099b2d35e5

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Mercado Pago (Consumer)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://solucionar-pagommensual.com/ Message: The resource https://www.google.com/recaptcha/enterprise.js?onload=onloadCallback&render=6LelVV4UAAAAADm4qkzt85y1Qh_n-JeoqwYIfX9u&hl=pt-BR was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
http2.mlstatic.com
solucionar-pagommensual.com
www.google.com
104.21.76.182
142.251.12.103
142.251.12.95
42.99.140.219
12500ae3773e6157e50b24a2809c53f603780f80b121c9f285810a5ad8175e54
48439d1952f13e8e74afab7ac1f6fe1b871b1572c87c51b679d0c94ccca6a8f4
4df8b6ba3ef52fd0fd697f6906ba6ec3af4876a4b660c608d6f266727dc147aa
6c50b3224ddbd7ddb1c188286e8c9683809a83220eb6483a63fd6bbf11b05fed
7aa9f61b090bbb746a4c687c1f94a65d8a93f43d42596e31cc9ae88d9982afbe
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
9411ab12b8dd65ce03ea7e1c62557fc2d1eaa1d5d1493609a14a2e29b8342918
9bb769c5a9f25f8d52e9ba56881641ec0ca019da478cf2910457fdbea01fcd14
a0d9a1de3d68002dc3c6cf31744b28d2ab5816f0c6e328c077971138f6583869

solucionar-pagommensual.com Open in urlscan Pro 104.21.76.182 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

81 kBTransfer

214 kBSize

0 Cookies

2 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

solucionar-pagommensual.com Open in urlscan Pro
104.21.76.182 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

81 kB
Transfer

214 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!