metodogregado-nuevosolicitado.com Open in urlscan Pro
172.67.181.87 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://metodogregado-nuevosolicitado.com/Dashboard/
Submission Tags: @ecarlesi threat #phishing #ml_ayuda Search All
Submission: On August 04 via api (August 4th 2023, 8:30:56 am UTC) from AU — Scanned from AU

Summary HTTP 9 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 9 HTTP transactions. The main IP is 172.67.181.87, located in United States and belongs to CLOUDFLARENET, US. The main domain is metodogregado-nuevosolicitado.com.
TLS certificate: Issued by GTS CA 1P5 on August 3rd 2023. Valid for: 3 months.

This is the only time metodogregado-nuevosolicitado.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Mercado Pago (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
3	172.67.181.87 172.67.181.87	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	74.125.24.95 74.125.24.95	15169 (GOOGLE) (GOOGLE)
4	184.87.193.68 184.87.193.68	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	64.233.170.106 64.233.170.106	15169 (GOOGLE) (GOOGLE)
9	4

3 172.67.181.87 (United States)

ASN13335 (CLOUDFLARENET, US)

metodogregado-nuevosolicitado.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.125.24.95 (United States)

ASN15169 (GOOGLE, US)
PTR: sf-in-f95.1e100.net

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 184.87.193.68 (Singapore)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a184-87-193-68.deploy.static.akamaitechnologies.com

http2.mlstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.233.170.106 (United States)

ASN15169 (GOOGLE, US)
PTR: sg-in-f106.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	mlstatic.com http2.mlstatic.com — Cisco Umbrella Rank: 24611	36 KB
3	metodogregado-nuevosolicitado.com metodogregado-nuevosolicitado.com	14 KB
1	google.com www.google.com — Cisco Umbrella Rank: 3	925 B
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 406	30 KB
9	4

	Domain	Requested by
4	http2.mlstatic.com	metodogregado-nuevosolicitado.com
3	metodogregado-nuevosolicitado.com	metodogregado-nuevosolicitado.com
1	www.google.com	metodogregado-nuevosolicitado.com
1	ajax.googleapis.com	metodogregado-nuevosolicitado.com
9	4

This site contains links to these domains. Also see Links.

Domain
policies.google.com

Subject Issuer	Validity	Valid
metodogregado-nuevosolicitado.com GTS CA 1P5	`2023-08-03` - `2023-11-01`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
*.mlstatic.com DigiCert TLS RSA SHA256 2020 CA1	`2023-04-08` - `2024-04-10`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://metodogregado-nuevosolicitado.com/Dashboard/
Frame ID: 076F3DAE240D5257B442739FBD616974
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

(1) Alerta importante!

Detected technologies

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+data-react

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

googleapis\.com/.+webfont

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

<link[^>]+recaptcha

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

81 kB
Transfer

214 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://policies.google.com/privacy?hl=es-AR
Title: Privacidad

Search URL Search Domain Scan URL

URL: https://policies.google.com/terms?hl=es-AR
Title: Condiciones

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
metodogregado-nuevosolicitado.com/Dashboard/ 8 KB
2 KB 1275ms
525ms Document
text/html 172.67.181.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://metodogregado-nuevosolicitado.com/Dashboard/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.181.87 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 48439d1952f13e8e74afab7ac1f6fe1b871b1572c87c51b679d0c94ccca6a8f4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7f1570cc3c10aad5-SYD
content-encoding: br
content-type: text/html
date: Fri, 04 Aug 2023 08:30:50 GMT
last-modified: Mon, 20 Jun 2022 05:54:31 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zNhzBpygd9vRsPehJ%2BklJOAEsktijrVt%2BcZqg77AOkxasFTG4mQyGg4%2FW6l3wrTffyFIDSf1X0K4toydgQ3rr6cKGTopEfujpN2ffYvTfEGlZCyy9CrjuHSrVtAhL0bClmYqEe4Tjo2SZBAtXZowtZlQ5Ws%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.2.1/ 85 KB
30 KB 864ms
187ms Script
text/javascript 74.125.24.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js

Requested by

Host: metodogregado-nuevosolicitado.com
URL: https://metodogregado-nuevosolicitado.com/Dashboard/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f95.1e100.net

Software

sffe /

Resource Hash

87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://metodogregado-nuevosolicitado.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:26:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 39836
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30306
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 02 Aug 2024 21:26:55 GMT

GET
H2 200 proximanova-light.woff2
http2.mlstatic.com/ui/webfonts/v3.0.0/proxima-nova/ 14 KB
14 KB 803ms
187ms Font
font/woff2 184.87.193.68
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://http2.mlstatic.com/ui/webfonts/v3.0.0/proxima-nova/proximanova-light.woff2

Requested by

Host: metodogregado-nuevosolicitado.com
URL: https://metodogregado-nuevosolicitado.com/Dashboard/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.87.193.68 , Singapore, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a184-87-193-68.deploy.static.akamaitechnologies.com

Software

Tengine /

Resource Hash

9bb769c5a9f25f8d52e9ba56881641ec0ca019da478cf2910457fdbea01fcd14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://metodogregado-nuevosolicitado.com/
Origin: https://metodogregado-nuevosolicitado.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-amz-version-id: C4CTuYdIvDB_0NcYDhbmfHFUFBfVxB.Q
content-encoding: gzip
x-content-type-options: nosniff
x-d2id: da777bea41a66e66aaae54fa84ea634f
x-cdn: a
date: Fri, 04 Aug 2023 08:30:51 GMT
x-amz-request-id: ZFD3F75K2EC05AHG
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
content-length: 14099
x-xss-protection: 1; mode=block
x-amz-id-2: tizlmlQ6irPLwE/mK5rV/O47fSZx1s+DT2tUZ0gcjbSYjCEyTUTCQX815g0irQVaL/n5r7xTViA=
x-request-id: da777bea41a66e66aaae54fa84ea634f
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 07 Jun 2022 03:26:46 GMT
server: Tengine
etag: "0de1fd16bf20e0b68646e390d439ab42"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *
x-request-device-id: da777bea41a66e66aaae54fa84ea634f

GET
H2 200 proximanova-regular.woff2
http2.mlstatic.com/ui/webfonts/v3.0.0/proxima-nova/ 14 KB
14 KB 817ms
202ms Font
font/woff2 184.87.193.68
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://http2.mlstatic.com/ui/webfonts/v3.0.0/proxima-nova/proximanova-regular.woff2

Requested by

Host: metodogregado-nuevosolicitado.com
URL: https://metodogregado-nuevosolicitado.com/Dashboard/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.87.193.68 , Singapore, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a184-87-193-68.deploy.static.akamaitechnologies.com

Software

Tengine /

Resource Hash

9411ab12b8dd65ce03ea7e1c62557fc2d1eaa1d5d1493609a14a2e29b8342918

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://metodogregado-nuevosolicitado.com/
Origin: https://metodogregado-nuevosolicitado.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-amz-version-id: MocYTiXX0FcyQ3NLXQ4zZuxDhFDOReik
content-encoding: gzip
x-content-type-options: nosniff
x-d2id: 7f4d5d2c-f3fe-4337-abf5-427e2882abaf
x-cdn: a
date: Fri, 04 Aug 2023 08:30:51 GMT
x-amz-request-id: KATGREAXPFMYQNH3
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
content-length: 14099
x-xss-protection: 1; mode=block
x-amz-id-2: sVUBLZmEQQ4gkRs5fTNMknf6BvpYZvr1DhgwA9wwI/3GQuz6KjqTdx6Yemm3WxuaNXprErGb0Rc=
x-request-id: 7f4d5d2c-f3fe-4337-abf5-427e2882abaf
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 07 Jun 2022 03:26:49 GMT
server: Tengine
etag: "67ff311675dbd02ddb898f02af6fddaf"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *
x-request-device-id: 7f4d5d2c-f3fe-4337-abf5-427e2882abaf

GET
H2 200 enterprise.js Show response
www.google.com/recaptcha/ 1000 B
925 B 874ms
198ms Script
text/javascript 64.233.170.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise.js?onload=onloadCallback&render=6LelVV4UAAAAADm4qkzt85y1Qh_n-JeoqwYIfX9u&hl=pt-BR

Requested by

Host: metodogregado-nuevosolicitado.com
URL: https://metodogregado-nuevosolicitado.com/Dashboard/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.170.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sg-in-f106.1e100.net

Software

GSE /

Resource Hash

12500ae3773e6157e50b24a2809c53f603780f80b121c9f285810a5ad8175e54

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://metodogregado-nuevosolicitado.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 08:30:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 605
x-xss-protection: 1; mode=block
expires: Fri, 04 Aug 2023 08:30:51 GMT

GET
H2 200 navigation.css
metodogregado-nuevosolicitado.com/Dashboard/Ol%C3%A1!%20Digite%20o%20seu%20e-mail%20ou%20usu%C3%A1rio_files/ 20 KB
4 KB 765ms
764ms Stylesheet
text/css 172.67.181.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://metodogregado-nuevosolicitado.com/Dashboard/Ol%C3%A1!%20Digite%20o%20seu%20e-mail%20ou%20usu%C3%A1rio_files/navigation.css
Requested by: Host: metodogregado-nuevosolicitado.com
URL: https://metodogregado-nuevosolicitado.com/Dashboard/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.181.87 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a0d9a1de3d68002dc3c6cf31744b28d2ab5816f0c6e328c077971138f6583869

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://metodogregado-nuevosolicitado.com/Dashboard/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 08:30:51 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 24 Nov 2020 03:26:56 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"5171-5b4d1e1ffd60e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8TRmHBf5AbrVEWMUaFSxLKER1lIeZv997OcoFxPBboKdnQ3kSnc3HHdw3bSVyC%2BIwBr69cy9LyovyDG3KlXIubH9KgQvusJf1VhnbugG0dKMDpmIhf6tJXTUzfxc49UpccoaE0x%2BAQ2vWiO3lzLRa6OWWiM%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 7f1570cf8fc4aad5-SYD
alt-svc: h3=":443"; ma=86400

GET
H2 200 style_mp.css
metodogregado-nuevosolicitado.com/Dashboard/Ol%C3%A1!%20Digite%20o%20seu%20e-mail%20ou%20usu%C3%A1rio_files/ 59 KB
7 KB 936ms
935ms Stylesheet
text/css 172.67.181.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://metodogregado-nuevosolicitado.com/Dashboard/Ol%C3%A1!%20Digite%20o%20seu%20e-mail%20ou%20usu%C3%A1rio_files/style_mp.css
Requested by: Host: metodogregado-nuevosolicitado.com
URL: https://metodogregado-nuevosolicitado.com/Dashboard/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.181.87 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6c50b3224ddbd7ddb1c188286e8c9683809a83220eb6483a63fd6bbf11b05fed

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://metodogregado-nuevosolicitado.com/Dashboard/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 08:30:51 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 24 Nov 2020 03:26:56 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"ed8b-5b4d1e1ffe993"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hlTLidg0KU9V2ZLI2ZMvM9s9ujtXI7laI3HEog0Dxw1S9nBn7RDW9FegezmiUp1E9qPSloiy6K4qS%2FpSFrK26TNXtQRl99woR0%2BRCO%2BU2fd09xjP9dcuEsE%2FhL0bXT2INFytphqYXAEnmlwSQI8hAMhB6Pk%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 7f1570cf8fc5aad5-SYD
alt-svc: h3=":443"; ma=86400

GET
H2 200 8006e27c2eb6345dc39a8c7736197fcd.svg
http2.mlstatic.com/frontend-assets/auth-login-frontend/ 12 KB
6 KB 772ms
387ms Image
image/svg+xml 184.87.193.68
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://http2.mlstatic.com/frontend-assets/auth-login-frontend/8006e27c2eb6345dc39a8c7736197fcd.svg

Requested by

Host: metodogregado-nuevosolicitado.com
URL: https://metodogregado-nuevosolicitado.com/Dashboard/Ol%C3%A1!%20Digite%20o%20seu%20e-mail%20ou%20usu%C3%A1rio_files/style_mp.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.87.193.68 , Singapore, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a184-87-193-68.deploy.static.akamaitechnologies.com

Software

Tengine /

Resource Hash

4df8b6ba3ef52fd0fd697f6906ba6ec3af4876a4b660c608d6f266727dc147aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://metodogregado-nuevosolicitado.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
x-d2id: a817b25b-7f3c-47cf-9a42-a97433efa666
x-permitted-cross-domain-policies: none
date: Fri, 04 Aug 2023 08:30:52 GMT
x-cdn: a
x-dns-prefetch-control: on
x-envoy-upstream-service-time: 124
content-length: 5735
x-xss-protection: 1; mode=block
x-request-id: a817b25b-7f3c-47cf-9a42-a97433efa666
referrer-policy: no-referrer-when-downgrade
server: Tengine
accept-ch: device-memory, dpr, viewport-width, rtt, downlink, ect, save-data
etag: "3181-UU8uUCOxL3IA+PjfeMdpHJjAOGM"
x-download-options: noopen
expect-ct: max-age=0
accept-ch-lifetime: 60
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
vary: Accept-Encoding
timing-allow-origin: *
x-request-device-id: a817b25b-7f3c-47cf-9a42-a97433efa666

GET
H2 200 9f137a27271b5e6fc3e2e1d9cb7a8783.svg
http2.mlstatic.com/frontend-assets/auth-login-frontend/ 757 B
1 KB 777ms
394ms Image
image/svg+xml 184.87.193.68
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://http2.mlstatic.com/frontend-assets/auth-login-frontend/9f137a27271b5e6fc3e2e1d9cb7a8783.svg

Requested by

Host: metodogregado-nuevosolicitado.com
URL: https://metodogregado-nuevosolicitado.com/Dashboard/Ol%C3%A1!%20Digite%20o%20seu%20e-mail%20ou%20usu%C3%A1rio_files/style_mp.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.87.193.68 , Singapore, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a184-87-193-68.deploy.static.akamaitechnologies.com

Software

Tengine /

Resource Hash

7aa9f61b090bbb746a4c687c1f94a65d8a93f43d42596e31cc9ae88d9982afbe

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://metodogregado-nuevosolicitado.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
date: Fri, 04 Aug 2023 08:30:52 GMT
x-content-type-options: nosniff
x-d2id: c37568ee-a830-468c-bca4-44099b2d35e5
x-permitted-cross-domain-policies: none
x-cdn: a
x-dns-prefetch-control: on
x-envoy-upstream-service-time: 70
alt-svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
content-length: 757
x-xss-protection: 1; mode=block
x-request-id: c37568ee-a830-468c-bca4-44099b2d35e5
referrer-policy: no-referrer-when-downgrade
server: Tengine
accept-ch: device-memory, dpr, viewport-width, rtt, downlink, ect, save-data
etag: "2f5-G9WJF/VY/AYsNEfgNQ/CmXYDh1s"
expect-ct: max-age=0
x-download-options: noopen
accept-ch-lifetime: 60
content-type: image/svg+xml; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
x-request-device-id: c37568ee-a830-468c-bca4-44099b2d35e5

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Mercado Pago (Consumer)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://metodogregado-nuevosolicitado.com/Dashboard/ Message: The resource https://www.google.com/recaptcha/enterprise.js?onload=onloadCallback&render=6LelVV4UAAAAADm4qkzt85y1Qh_n-JeoqwYIfX9u&hl=pt-BR was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
http2.mlstatic.com
metodogregado-nuevosolicitado.com
www.google.com
172.67.181.87
184.87.193.68
64.233.170.106
74.125.24.95
12500ae3773e6157e50b24a2809c53f603780f80b121c9f285810a5ad8175e54
48439d1952f13e8e74afab7ac1f6fe1b871b1572c87c51b679d0c94ccca6a8f4
4df8b6ba3ef52fd0fd697f6906ba6ec3af4876a4b660c608d6f266727dc147aa
6c50b3224ddbd7ddb1c188286e8c9683809a83220eb6483a63fd6bbf11b05fed
7aa9f61b090bbb746a4c687c1f94a65d8a93f43d42596e31cc9ae88d9982afbe
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
9411ab12b8dd65ce03ea7e1c62557fc2d1eaa1d5d1493609a14a2e29b8342918
9bb769c5a9f25f8d52e9ba56881641ec0ca019da478cf2910457fdbea01fcd14
a0d9a1de3d68002dc3c6cf31744b28d2ab5816f0c6e328c077971138f6583869

metodogregado-nuevosolicitado.com Open in urlscan Pro 172.67.181.87 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

81 kBTransfer

214 kBSize

0 Cookies

2 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

metodogregado-nuevosolicitado.com Open in urlscan Pro
172.67.181.87 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

81 kB
Transfer

214 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!