MercadoLibre Recon
Reconnaissance reports and source data.
HTTP Recon & Bug Bounty Report
# MercadoLibre — HTTP Recon & Bug Bounty Report
**Target:** `mercadolibre.com` / `mercadolivre.com` / `mercadolibre.com.ar` (+ country TLDs)
**Method:** subdomain recon → CT logs → DNS → `httpx` probing → manual curl verification
**Tools:** ctlogs.dev, certspotter, crt.sh, httpx, curl, jq
---
## 1. Executive Summary
| Metric | Count |
|---|---|
| Total targets probed | 80 |
| Live HTTP/HTTPS hosts | 53 |
| Dead / unreachable / internal-only | 27 |
| **High-value findings** | **1 critical, 3 notable** |
---
## 2. 🎯 Key Findings (Bug Bounty Priorities)
### 🔴 CRITICAL — `artifacts.mercadolibre.com`
**Sonatype Nexus Repository Manager — PUBLICLY EXPOSED**
| Probe | Result |
|---|---|
| `/` (UI) | HTTP 200 (Sonatype Nexus Repository title) |
| `/service/rest/v1/repositories` | HTTP **200** — lists all internal repos, **NO AUTH** |
| `/service/rest/v1/search/assets?repository=ios-releases` | HTTP **200** — returns full asset metadata |
| `/repository/ios-releases/AndesUI/3.27.14/AndesUI.zip` | HTTP **200** — actual file downloadable (809 KB) |
| `/service/rest/v1/status/writable` | HTTP 200 (Nexus writable check) |
| `/service/rest/v1/security/users` | HTTP 403 (auth required) |
**Exposed repositories:**
```
ios-releases raw hosted 349,443,371 bytes
android-releases maven2 hosted 1,339,419,938 bytes
android-experimental maven2 hosted 15,080,460 bytes
extra maven2 proxy 4,504,305 bytes
ios-experimental raw hosted 0
bintray-android-public maven2 proxy 0
oss-ios-releases raw proxy 0
oss-android-releases maven2 proxy 6,678
```
**Headers returned on artifact download:**
```
server: nginx/1.29.4
access-control-allow-origin: *
content-security-policy: sandbox allow-forms ...
```
**Why this matters:** internal build artifacts (Android `.apk`/`.jar`, iOS `.zip` framework bundles) are enumerable and downloadable by anyone on the internet. `access-control-allow-origin: *` makes it trivially scriptable. Look for:
- Hardcoded API keys / tokens baked into those artifacts
- Reverse-engineer release binaries for signed-in internal endpoints
- Supply-chain attack surface (can anyone upload? `status/writable=200` suggests possibility)
**Report template:** "Unauthenticated Access to Internal Artifact Repository (Sonatype Nexus) on artifacts.mercadolibre.com allows disclosure of proprietary Android/iOS build binaries."
---
### 🟠 NOTABLE — `fooddeliverywebapp.mercadolibre.com`
**AWS S3 bucket behind CloudFront**
| Probe | Result |
|---|---|
| HTTPS root | HTTP 403, `x-amz-bucket-region: us-east-1`, `x-amz-id-2`, `x-amz-request-id` leaked |
| `/?list-type=2&max-keys=10` | `AccessDenied` (good, no public listing) |
| `Host: fooddeliverywebapp.mercadolibre.com` on HTTP | HTTP 301 → `https://fooddeliverywebapp.mercadolibre.com:443/` |
| httpx (first probe) | HTTP 307 → `http://fooddeliverywebapp.mercadolibre.com:9001` |
The redirect to **port 9001** is anomalous — it suggests an upstream origin server on a non-standard port. Try:
- `https://fooddeliverywebapp.mercadolibre.com:9001/` (probably blocked by LB)
- Probe common paths: `/health`, `/api`, `/status`, `/actuator/health`
- Check S3 bucket naming convention (`fooddeliverywebapp-*`, search public buckets for similar name)
---
### 🟠 NOTABLE — SAML/Auth0 `next` parameter on learning portals
**`learning.mercadolibre.com`** and **`learninghub.mercadolibre.com.ar`** both redirect to `/login?next=<path>&tpa_hint=<auth-strategy>`.
```
https://learning.mercadolibre.com/login?next=%2F%3Ftpa_hint%3Dsaml-auth0-saml
https://learninghub.mercadolibre.com.ar/login?next=%2F%3Ftpa_hint%3Doa2-marketplace-id
```
- Direct injection of `next=https://evil.example.com` returned **HTTP 403** (good — SSRF/open-redirect blocked).
- However, the `tpa_hint` parameter names an Auth0 connection strategy. **Try enumerating other tpa_hint values** (`google-oauth2`, `auth0`, `saml`, `passwordless`, etc.) — misconfiguration may allow identity-provider bypass.
---
### 🟡 INTERESTING — `events-ads.mercadolibre.com`
**HTTP 421 Misdirected Request**
```
x-served-by: cache-fra-etou8220121
```
The header `x-served-by` resembles **Fastly** infrastructure. HTTP 421 means the request was sent to the wrong origin/edge node. This could be:
- A routing bug (send a specific Host header to make it work)
- A stale CDN configuration (old production endpoints still cached)
- Try adding different `Host:` headers or probing alternate paths (`/health`, `/status`, `/metrics`).
---
## 3. Full HTTPX Result Table (All 53 Live Hosts)
Legend: 🔴 high-value · 🟠 medium · 🟡 low · ⚪ informational
| Host | Code | Title | Server/Tech | IP | Notes |
|---|---|---|---|---|---|
| api.mercadolibre.com | 404 | — | CloudFront | 52.222.214.49 | Main public API — expects valid paths |
| **artifacts.mercadolibre.com** 🔴 | 200 | Sonatype Nexus Repository | nginx/1.29.4 | 100.60.82.53 | **Unauthenticated repo listing + download** |
| andes-landings.mercadolibre.com | 200 | Andes Landings | Ruby on Rails | 54.195.237.234 | Landing page framework |
| andes.mercadolibre.com | 200 | Andes Design System | Ruby on Rails | 52.51.23.169 | Design-system docs |
| andesx.mercadolibre.com | 200 | Andes X | Ruby on Rails | 52.51.23.169 | Design-system variant |
| career.mercadolibre.com | 307 → `/es` | — | Tengine/3.1.0 + CloudFront | 52.222.136.23 | Language-based redirect |
| careers-meli.mercadolibre.com | 307 → `/es` | — | Tengine/3.1.0 + CloudFront | 2600:9000:... | Same as career |
| centrodepartners.mercadolibre.com | 200 | Centro de Partners | nginx + Envoy | 99.84.152.3 | Partner portal |
| developers.mercadolibre.com | 200 | — | nginx + Envoy | 99.84.152.115 | Developer docs portal |
| **events-ads.mercadolibre.com** 🟡 | 421 | — | Fastly-like (x-served-by) | 151.101.194.133 | Misdirected request |
| **fooddeliverywebapp.mercadolibre.com** 🟠 | 403/307 | — | AWS S3 us-east-1 | 34.234.14.175 | S3 bucket + :9001 redirect |
| global-selling.mercadolibre.com | 302 → `/summary` | — | nginx + Envoy | 99.84.152.3 | /summary requires auth (403) |
| hp.mercadolibre.com | 200 | — | nginx + Envoy | 99.84.152.115 | Empty body (4 bytes) |
| investor.mercadolibre.com | 200 | Mercado Libre \| Investor Relations | nginx | 99.84.152.3 | Public IR site |
| jobs-test.mercadolibre.com | 307 → `/es` | — | Tengine/3.1.0 + CloudFront | 2600:9000:... | **"test" naming** — possibly staging jobs portal |
| learning.mercadolibre.com | 302 | — | nginx + CloudFront | 99.84.152.18 | Auth0 SAML hint |
| learninghub-int.mercadolibre.com | 403 | — | awselb/2.0 | 35.169.138.84 | Internal learning hub |
| learninghub.mercadolibre.com.ar | 302 | — | — | 35.169.138.84 | Marketplace OAuth hint |
| manualdeestilo.mercadolibre.com | 200 | Manual de estilo | Ruby on Rails | 52.51.23.169 | Style guide |
| mercadolibre.com | 200 | Mercado Libre - Envíos Gratis en el día | nginx | 3.33.182.45 | Main site |
| mercadolibre.com.{bo,co,do,ec,gt,hn,mx,ni,pe,py,pa,sv,uy,ve} | 301 | → www.<tld>/ | nginx + CloudFront | various | Standard country redirects |
| mercadolivre.com | 301 | → mercadolivre.com.br | nginx + CloudFront | 13.32.99.60 | Country redirect |
| news.mercadolivre.com | 301 | → news.mercadolibre.com | nginx + CloudFront | 13.32.99.44 | Language redirect |
| news.mercadolibre.com | 200 | Home \| Mercado Libre | **Drupal 10 + PHP** + CloudFront | 2600:9000:... | **CMS — check for /user/login, update.php** |
| op-scim.mercadolibre.com | 307 → `/app/` | — | — | 98.85.238.48 | SCIM provisioner (Okta?) |
| play.mercadolibre.com | 302 → `/no-disponible` | — | nginx + Envoy | 3.173.161.86 | "Not available" page |
| pppi-stg.mercadolibre.com | 200 | Brand Protection Program | **AmazonS3** | 2600:9000:... | **Staging environment** |
| pppi.mercadolibre.com | 200 | Brand Protection Program | Tengine/3.1.0 | 2600:9000:... | Production version |
| realtime-dev.global-selling.mercadolibre.com | 403 | — | awselb/2.0 | 52.0.61.254 | Dev realtime (ELB) |
| realtime-prod.global-selling.mercadolibre.com | 403 | — | awselb/2.0 | 184.197.193.205 | Prod realtime (ELB) |
| realtime-prod.sellers.mercadolibre.com | 403 | — | awselb/2.0 | 32.194.211.180 | Prod realtime (ELB) |
| sellers.mercadolibre.com | 302 → global-selling/sales-summary | — | nginx + Envoy | 143.204.55.23 | Alias |
| survey.mercadolibre.com | 302 → `/login` | — | — | 2.20.143.90 | Survey portal (Akamai IP?) |
| universidad.mercadolibre.com | 403 | — | CloudFront + React | 52.222.136.128 | Blocked by WAF |
| ux.mercadolibre.com | 200 | Mercado Libre UX | Tengine | 2600:9000:... | UX/brand portal |
| vendedores.mercadolibre.com | 200 | Central de vendedores | nginx + Envoy | 99.84.152.45 | Seller dashboard |
| vendorhub.mercadolibre.com | 302 → `/login` | — | nginx + Envoy | 99.84.152.3 | Vendor login |
| www.mercadolibre.com | 200 | Mercado Libre - Envíos Gratis | awselb/2.0 | 15.197.170.90 | Main prod |
| www.mercadolibre.com.ar | 200 | Mercado Libre Argentina | nginx + Envoy | 15.197.170.90 | Main prod AR |
---
## 4. No-Response Hosts (27)
These are likely internal-only or DNS-only without a public HTTP service:
```
alejandria-int.mercadolibre.com ← internal
alejandria.mercadolibre.com.ar
bc-jpm-beta-ssl.mercadolibre.com ← blockchain/jpm?
bc-jpm-beta-transfer.mercadolibre.com
bc-jpm-beta-update.mercadolibre.com
bc-jpm-beta-update.mercadolibre.com.mercadolibre.com ← malformed (CT log bug)
careers.mercadolibre.com
hom-proxy-urutec.mercadolibre.com ← Uruguay proxy
homl-proxy-urutec.mercadolibre.com
internal-api.mercadolibre.com ← 10.54.29.x (PRIVATE IP!)
learninghub-studio-int.mercadolibre.com ← internal
nginx.m-int-dev.mercadolibre.com ← internal nginx cluster
nginx.m-int-prd.mercadolibre.com
nginx.s1-int-dev.mercadolibre.com
nginx.s1-int-prd.mercadolibre.com
nginx.s1-pub-prd.mercadolibre.com ← "pub" but no response
nginx.s2-int-prd.mercadolibre.com
nginx.s2-pub-prd.mercadolibre.com
prod-proxy-urutec.mercadolibre.com
prodeng-internal.mercadolibre.com ← prod engineering
prodeng-playground-internal.mercadolibre.com
realtime-dev.mercadolibre.com.ar
realtime-prod.mercadolibre.com.ar
sdl-agent.mercadolibre.com
soap.mercadolibre.com ← SOAP endpoint (maybe non-HTTP)
treasury.mercadolibre.com
voice-agents.tcp.s1-int-prd.mercadolibre.com ← TCP-only
```
**Note:** `internal-api.mercadolibre.com` and `artifacts.mercadolibre.com` are the only hosts that resolved to private IPs (10.54.29.188 and 100.60.82.53). Everything else has public IPs.
---
## 5. Technology Stack Summary
| Tech | Count | Usage |
|---|---|---|
| nginx | ~35 | Most common server |
| Amazon CloudFront | ~25 | CDN for CloudFront routes |
| Amazon Web Services | ~25 | Underlying infra |
| Tengine | 5 | Alternative nginx fork |
| awselb/2.0 | 5 | AWS ALB |
| Ruby on Rails | 4 | Design systems (andes*, manualdeestilo) |
| **Drupal 10 + PHP** | 1 | news.mercadolibre.com |
| Envoy | ~10 | Service mesh proxies |
| Google Cloud | 2 | careers endpoints |
---
## 6. Bug Bounty Hunting Recommendations
### Highest Impact — `artifacts.mercadolibre.com`
1. **Enumerate all artifacts** via `/service/rest/v1/search/assets?repository=ios-releases&sort=version` and `android-releases`
2. **Search for secrets in binaries** — run `strings` / `grep -a` against downloaded artifacts for API keys, client IDs, private endpoints
3. **Look for proxy repositories** (`oss-*`, `bintray-*`) — potential **SSRF** if Nexus allows custom upstream
4. **Check for upload permissions** — POST to `/service/rest/v1/repositories/<name>/...` to see if writable (Nexus default "anonymous upload" is sometimes left on)
5. **Version disclosure** — server header says nginx/1.29.4 (very recent). Nexus itself may have CVEs if version is old
### Medium Impact — Auth flows
1. `learning.mercadolibre.com` — try different `tpa_hint` values to see if unauthorized SAML connections are accepted
2. `learninghub.mercadolibre.com.ar` — same strategy
3. `vendorhub.mercadolibre.com` `/login` — check for default accounts, password reset enumeration
4. `pppi-stg.mercadolibre.com` vs `pppi.mercadolibre.com` — content differs (different md5). Staging may have looser auth or test data
### Low Impact but worth trying
1. `jobs-test.mercadolibre.com` — "test" in the name. Maybe has debug endpoints
2. `events-ads.mercadolibre.com` 421 — send different Host headers or `/health`/`/metrics`
3. `news.mercadolibre.com` — Drupal 10: check `/user/login`, `/update.php`, `/admin`, REST endpoints, CORS
4. `op-scim.mercadolibre.com` → `/app/` — likely Okta SCIM; look for provisioner config leak
5. `bc-jpm-*` — sounds like a "JPMorgan" payment gateway beta; DNS resolves but no HTTP. Maybe non-HTTP protocol or IP-restricted
6. `soap.mercadolibre.com` — legacy SOAP endpoint; try common WSDL paths (`/?wsdl`, `/services/`, `/axis2/`)
7. `survey.mercadolibre.com` — 2.20.143.90 is likely Akamai. Survey portals often have XSS in question metadata
### Wildcard expansion targets
From cert data, these wildcards were found — probe the sub-hosts they cover:
```
*.realtime-dev.global-selling.mercadolibre.com
*.realtime-prod.global-selling.mercadolibre.com
*.realtime-prod.sellers.mercadolibre.com
*.sellers.mercadolibre.com
*.nginx.m-int-dev.mercadolibre.com
*.nginx.m-int-prd.mercadolibre.com
*.nginx.s1-int-dev.mercadolibre.com
*.nginx.s1-int-prd.mercadolibre.com
*.nginx.s1-pub-prd.mercadolibre.com
*.nginx.s2-int-prd.mercadolibre.com
*.nginx.s2-pub-prd.mercadolibre.com
*.prodeng-internal.mercadolibre.com
*.prodeng-playground-internal.mercadolibre.com
*.hom-proxy-urutec.mercadolibre.com
*.homl-proxy-urutec.mercadolibre.com
*.prod-proxy-urutec.mercadolibre.com
```
### Cross-country domains
```
mercadolibre.com.bo / .com.co / .com.do / .com.ec / .com.gt
mercadolibre.com.hn / .com.mx / .com.ni / .com.pa / .com.pe
mercadolibre.com.py / .com.sv / .com.uy / .com.ve
mercadolivre.com (Brazil)
```
Each has the same API/developers subdomain pattern — often weakly tested for country-specific bugs.
---
## 7. Report Template (Ready to Submit)
**Title:** Unauthenticated Access to Sonatype Nexus Repository (artifacts.mercadolibre.com)
**Severity:** Critical / High
**Description:**
The host `artifacts.mercadolibre.com` hosts a Sonatype Nexus Repository Manager. An unauthenticated user can:
1. Enumerate all configured repositories via `GET /service/rest/v1/repositories`
2. Query asset metadata via `GET /service/rest/v1/search/assets?repository=<name>`
3. Download proprietary build artifacts (e.g., iOS framework `.zip`, Android maven2 packages)
**PoC:**
```bash
curl 'https://artifacts.mercadolibre.com/service/rest/v1/repositories' | jq '.[] | .name'
curl 'https://artifacts.mercadolibre.com/service/rest/v1/search/assets?repository=ios-releases'
curl -I 'https://artifacts.mercadolibre.com/repository/ios-releases/AndesUI/3.27.14/AndesUI.zip'
```
**Impact:**
- Proprietary source-level build artifacts publicly available
- Potential secret leakage in build binaries
- CORS `*` on all assets allows scripted exfiltration
- `access-control-allow-origin: *` combined with `sandbox` CSP makes this an attractive vector
**Remediation:**
- Require authentication for all Nexus REST endpoints
- Restrict repository-level anonymous read to specific IPs
- Ensure `status/writable` is not exposed
---
## 8. Files Produced
```
/Users/gashtasb/Desktop/mercadolibre_recon/
├── BUGBOUNTY_REPORT.md ← this file
├── REPORT.md ← CT/DNS recon report
├── cert_finder.py ← reusable recon script
├── input_domains.txt
├── certs/
│ ├── ctlogs_dev.json
│ ├── certspotter.json
│ └── crt_sh.json
├── subdomains/
│ ├── httpx_results.txt ← raw httpx output (53 live)
│ ├── subdomains_merged.txt ← 66 unique subdomains
│ ├── related_domains.txt ← 14 country TLD variants
│ └── wildcards_found.txt ← 22 wildcard certs
└── dns/
├── dns_resolution.json
├── dns_resolution.txt
└── unique_ips.txt ← 191 unique IPs
```
Certificate & Subdomain Recon Report
# MercadoLibre Certificate & Subdomain Recon Report Generated: 2026-11-04T22:36:01.980848+00:00 Input domains: 24 (see `input_domains.txt`) Base domains: mercadolibre.com, mercadolibre.com.ar, mercadolivre.com ## 1. Sources used | Source | Status | Result | |---|---|---| | ctlogs.dev | OK | 100 unique certs, 49 hosts | | certspotter.com | OK | 86 issuances, 56 hosts | | crt.sh | OK | 80 entries | | search.censys.io | skipped | v1 search decommissioned; needs v2 API key | | crt.cloudflare.com | failed | DNS does not resolve (host unreachable) | | dns.he.net | manual | web-only, no public JSON API | ## 2. Summary numbers - Unique subdomains discovered: **66** - Wildcard cert names: **22** - Hosts resolving to IPs: **56** - Unique IPs: **191** ## 3. Discovered subdomains (merged from CT sources) ``` alejandria-int.mercadolibre.com alejandria.mercadolibre.com.ar andes-landings.mercadolibre.com andes.mercadolibre.com andesx.mercadolibre.com api.mercadolibre.com artifacts.mercadolibre.com bc-jpm-beta-ssl.mercadolibre.com bc-jpm-beta-transfer.mercadolibre.com bc-jpm-beta-update.mercadolibre.com bc-jpm-beta-update.mercadolibre.com.mercadolibre.com career.mercadolibre.com careers-meli.mercadolibre.com careers.mercadolibre.com centrodepartners.mercadolibre.com developers.mercadolibre.com events-ads.mercadolibre.com fooddeliverywebapp.mercadolibre.com global-selling.mercadolibre.com hom-proxy-urutec.mercadolibre.com homl-proxy-urutec.mercadolibre.com hp.mercadolibre.com internal-api.mercadolibre.com investor.mercadolibre.com jobs-test.mercadolibre.com learning.mercadolibre.com learninghub-int.mercadolibre.com learninghub-studio-int.mercadolibre.com learninghub.mercadolibre.com.ar manualdeestilo.mercadolibre.com mercadolibre.com mercadolibre.com.ar mercadolivre.com news.mercadolibre.com news.mercadolivre.com nginx.m-int-dev.mercadolibre.com nginx.m-int-prd.mercadolibre.com nginx.s1-int-dev.mercadolibre.com nginx.s1-int-prd.mercadolibre.com nginx.s1-pub-prd.mercadolibre.com nginx.s2-int-prd.mercadolibre.com nginx.s2-pub-prd.mercadolibre.com op-scim.mercadolibre.com play.mercadolibre.com pppi-stg.mercadolibre.com pppi.mercadolibre.com prod-proxy-urutec.mercadolibre.com prodeng-internal.mercadolibre.com prodeng-playground-internal.mercadolibre.com realtime-dev.global-selling.mercadolibre.com realtime-dev.mercadolibre.com.ar realtime-prod.global-selling.mercadolibre.com realtime-prod.mercadolibre.com.ar realtime-prod.sellers.mercadolibre.com sdl-agent.mercadolibre.com sellers.mercadolibre.com soap.mercadolibre.com survey.mercadolibre.com treasury.mercadolibre.com universidad.mercadolibre.com ux.mercadolibre.com vendedores.mercadolibre.com vendorhub.mercadolibre.com voice-agents.tcp.s1-int-prd.mercadolibre.com www.mercadolibre.com www.mercadolibre.com.ar ``` ## 4. Wildcards seen in certificates ``` *.hom-proxy-urutec.mercadolibre.com *.homl-proxy-urutec.mercadolibre.com *.mercadolibre.com *.mercadolibre.com.ar *.mercadolivre.com *.nginx.m-int-dev.mercadolibre.com *.nginx.m-int-prd.mercadolibre.com *.nginx.s1-int-dev.mercadolibre.com *.nginx.s1-int-prd.mercadolibre.com *.nginx.s1-pub-prd.mercadolibre.com *.nginx.s2-int-prd.mercadolibre.com *.nginx.s2-pub-prd.mercadolibre.com *.prod-proxy-urutec.mercadolibre.com *.prodeng-internal.mercadolibre.com *.prodeng-playground-internal.mercadolibre.com *.realtime-dev.global-selling.mercadolibre.com *.realtime-dev.mercadolibre.com.ar *.realtime-dev.sellers.mercadolibre.com *.realtime-prod.global-selling.mercadolibre.com *.realtime-prod.mercadolibre.com.ar *.realtime-prod.sellers.mercadolibre.com *.sellers.mercadolibre.com ``` ## 5. DNS resolution (host -> IP) ``` andes-landings.mercadolibre.com 52.51.23.169, 54.195.237.234, 63.33.17.94 andes.mercadolibre.com 63.33.17.94, 54.195.237.234, 52.51.23.169 andesx.mercadolibre.com 54.195.237.234, 63.33.17.94, 52.51.23.169 api.mercadolibre.com 3.160.150.13, 3.160.150.109, 3.160.150.30, 3.160.150.68 artifacts.mercadolibre.com 100.60.82.53, 184.197.9.77 career.mercadolibre.com 52.222.136.28, 52.222.136.128, 52.222.136.48, 52.222.136.23, 2600:9000:2204:a200:2:6cf7:7b00:93a1, 2600:9000:2204:8c00:2:6cf7:7b00:93a1, 2600:9000:2204:7200:2:6cf7:7b00:93a1, 2600:9000:2204:d400:2:6cf7:7b00:93a1, 2600:9000:2204:9e00:2:6cf7:7b00:93a1, 2600:9000:2204:7600:2:6cf7:7b00:93a1, 2600:9000:2204:c000:2:6cf7:7b00:93a1, 2600:9000:2204:5e00:2:6cf7:7b00:93a1 careers-meli.mercadolibre.com 52.222.136.23, 52.222.136.128, 52.222.136.48, 52.222.136.28, 2600:9000:2204:bc00:2:6cf7:7b00:93a1, 2600:9000:2204:8c00:2:6cf7:7b00:93a1, 2600:9000:2204:3800:2:6cf7:7b00:93a1, 2600:9000:2204:4c00:2:6cf7:7b00:93a1, 2600:9000:2204:6000:2:6cf7:7b00:93a1, 2600:9000:2204:1e00:2:6cf7:7b00:93a1, 2600:9000:2204:3a00:2:6cf7:7b00:93a1, 2600:9000:2204:ee00:2:6cf7:7b00:93a1 centrodepartners.mercadolibre.com 99.84.152.88, 99.84.152.3, 99.84.152.115, 99.84.152.45 developers.mercadolibre.com 3.173.161.91, 3.173.161.69, 3.173.161.86, 3.173.161.51 events-ads.mercadolibre.com 151.101.2.133, 151.101.194.133, 151.101.130.133, 151.101.66.133 fooddeliverywebapp.mercadolibre.com 18.214.229.91, 34.234.14.175, 35.169.138.84 global-selling.mercadolibre.com 99.84.152.115, 99.84.152.45, 99.84.152.3, 99.84.152.88 hp.mercadolibre.com 99.84.152.115, 99.84.152.45, 99.84.152.3, 99.84.152.88 internal-api.mercadolibre.com 10.54.29.188, 10.54.29.86 investor.mercadolibre.com 3.174.255.25, 3.174.255.81, 3.174.255.85, 3.174.255.114 jobs-test.mercadolibre.com 52.222.136.48, 52.222.136.28, 52.222.136.23, 52.222.136.128, 2600:9000:2204:5600:2:6cf7:7b00:93a1, 2600:9000:2204:1000:2:6cf7:7b00:93a1, 2600:9000:2204:800:2:6cf7:7b00:93a1, 2600:9000:2204:3c00:2:6cf7:7b00:93a1, 2600:9000:2204:9e00:2:6cf7:7b00:93a1, 2600:9000:2204:a00:2:6cf7:7b00:93a1, 2600:9000:2204:6400:2:6cf7:7b00:93a1, 2600:9000:2204:8800:2:6cf7:7b00:93a1 learning.mercadolibre.com 54.192.138.68, 54.192.138.9, 54.192.138.115, 54.192.138.87, 2600:9000:2062:3200:19:ef9b:f240:93a1, 2600:9000:2062:6a00:19:ef9b:f240:93a1, 2600:9000:2062:8200:19:ef9b:f240:93a1, 2600:9000:2062:6c00:19:ef9b:f240:93a1, 2600:9000:2062:5e00:19:ef9b:f240:93a1, 2600:9000:2062:4a00:19:ef9b:f240:93a1, 2600:9000:2062:c000:19:ef9b:f240:93a1, 2600:9000:2062:9400:19:ef9b:f240:93a1 learninghub-int.mercadolibre.com 34.234.14.175, 18.214.229.91, 35.169.138.84 learninghub.mercadolibre.com.ar 34.234.14.175, 35.169.138.84, 18.214.229.91 manualdeestilo.mercadolibre.com 52.51.23.169, 63.33.17.94, 54.195.237.234 mercadolibre.com 15.197.170.90, 3.33.182.45 mercadolibre.com.ar 3.33.182.45, 15.197.170.90 mercadolibre.com.bo 65.9.130.93, 65.9.130.100, 65.9.130.29, 65.9.130.46 mercadolibre.com.co 13.226.244.18, 13.226.244.84, 13.226.244.46, 13.226.244.76 mercadolibre.com.do 18.245.46.60, 18.245.46.19, 18.245.46.115, 18.245.46.71 mercadolibre.com.ec 18.172.112.106, 18.172.112.30, 18.172.112.103, 18.172.112.76 mercadolibre.com.gt 18.66.112.48, 18.66.112.55, 18.66.112.126, 18.66.112.98 mercadolibre.com.hn 54.192.35.79, 54.192.35.112, 54.192.35.91, 54.192.35.38 mercadolibre.com.mx 15.197.170.90, 3.33.182.45 mercadolibre.com.ni 18.66.102.69, 18.66.102.7, 18.66.102.4, 18.66.102.83 mercadolibre.com.pa 54.192.35.18, 54.192.35.126, 54.192.35.50, 54.192.35.57 mercadolibre.com.pe 18.64.211.100, 18.64.211.97, 18.64.211.107, 18.64.211.48 mercadolibre.com.py 13.226.244.77, 13.226.244.27, 13.226.244.67, 13.226.244.57 mercadolibre.com.sv 54.192.35.47, 54.192.35.45, 54.192.35.126, 54.192.35.5 mercadolibre.com.uy 18.66.102.34, 18.66.102.26, 18.66.102.55, 18.66.102.35 mercadolibre.com.ve 3.33.182.45, 15.197.170.90 mercadolivre.com 18.239.18.128, 18.239.18.18, 18.239.18.70, 18.239.18.125 news.mercadolibre.com 18.239.36.86, 18.239.36.42, 18.239.36.98, 18.239.36.31, 2600:9000:2670:f800:17:4d4d:7280:93a1, 2600:9000:2670:1e00:17:4d4d:7280:93a1, 2600:9000:2670:d200:17:4d4d:7280:93a1, 2600:9000:2670:4c00:17:4d4d:7280:93a1, 2600:9000:2670:9c00:17:4d4d:7280:93a1, 2600:9000:2670:8a00:17:4d4d:7280:93a1, 2600:9000:2670:3c00:17:4d4d:7280:93a1, 2600:9000:2670:800:17:4d4d:7280:93a1 news.mercadolivre.com 18.239.18.125, 18.239.18.128, 18.239.18.70, 18.239.18.18 nginx.m-int-prd.mercadolibre.com 34.236.53.36, 184.193.128.184, 100.51.119.128 op-scim.mercadolibre.com 98.85.238.48, 34.196.191.70 play.mercadolibre.com 99.84.152.115, 99.84.152.3, 99.84.152.88, 99.84.152.45 pppi-stg.mercadolibre.com 65.8.131.87, 65.8.131.72, 65.8.131.88, 65.8.131.21, 2600:9000:208a:e00:12:244e:af40:93a1, 2600:9000:208a:9c00:12:244e:af40:93a1, 2600:9000:208a:4c00:12:244e:af40:93a1, 2600:9000:208a:8200:12:244e:af40:93a1, 2600:9000:208a:9200:12:244e:af40:93a1, 2600:9000:208a:dc00:12:244e:af40:93a1, 2600:9000:208a:a600:12:244e:af40:93a1, 2600:9000:208a:1c00:12:244e:af40:93a1 pppi.mercadolibre.com 52.222.136.28, 52.222.136.128, 52.222.136.48, 52.222.136.23, 2600:9000:2204:b000:2:6cf7:7b00:93a1, 2600:9000:2204:6200:2:6cf7:7b00:93a1, 2600:9000:2204:a200:2:6cf7:7b00:93a1, 2600:9000:2204:fa00:2:6cf7:7b00:93a1, 2600:9000:2204:ce00:2:6cf7:7b00:93a1, 2600:9000:2204:3000:2:6cf7:7b00:93a1, 2600:9000:2204:4600:2:6cf7:7b00:93a1, 2600:9000:2204:e800:2:6cf7:7b00:93a1 realtime-dev.global-selling.mercadolibre.com 52.0.61.254, 52.202.224.168, 52.203.111.41 realtime-prod.global-selling.mercadolibre.com 98.89.200.103, 34.237.210.94, 184.194.163.128, 3.228.111.108, 184.197.193.205, 184.198.50.150, 54.204.196.190, 32.194.211.180 realtime-prod.sellers.mercadolibre.com 3.228.111.108, 32.194.211.180, 34.237.210.94, 52.1.76.3, 184.197.193.205, 54.204.196.190, 184.194.163.128, 184.198.50.150 sdl-agent.mercadolibre.com 3.220.221.85, 52.1.204.20 sellers.mercadolibre.com 3.173.161.51, 3.173.161.69, 3.173.161.91, 3.173.161.86 survey.mercadolibre.com 2.20.142.19, 2.20.143.90 universidad.mercadolibre.com 52.222.136.128, 52.222.136.28, 52.222.136.48, 52.222.136.23, 2600:9000:2204:8e00:2:6cf7:7b00:93a1, 2600:9000:2204:7400:2:6cf7:7b00:93a1, 2600:9000:2204:1000:2:6cf7:7b00:93a1, 2600:9000:2204:4800:2:6cf7:7b00:93a1, 2600:9000:2204:2c00:2:6cf7:7b00:93a1, 2600:9000:2204:c000:2:6cf7:7b00:93a1, 2600:9000:2204:2400:2:6cf7:7b00:93a1, 2600:9000:2204:d200:2:6cf7:7b00:93a1 ux.mercadolibre.com 18.239.50.42, 18.239.50.67, 18.239.50.102, 18.239.50.114, 2600:9000:20ab:a600:16:66a5:8080:93a1, 2600:9000:20ab:ec00:16:66a5:8080:93a1, 2600:9000:20ab:a00:16:66a5:8080:93a1, 2600:9000:20ab:0:16:66a5:8080:93a1, 2600:9000:20ab:2200:16:66a5:8080:93a1, 2600:9000:20ab:de00:16:66a5:8080:93a1, 2600:9000:20ab:3e00:16:66a5:8080:93a1, 2600:9000:20ab:ce00:16:66a5:8080:93a1 vendedores.mercadolibre.com 3.173.161.51, 3.173.161.69, 3.173.161.91, 3.173.161.86 vendorhub.mercadolibre.com 3.173.161.86, 3.173.161.69, 3.173.161.51, 3.173.161.91 www.mercadolibre.com 3.33.182.45, 15.197.170.90 www.mercadolibre.com.ar 15.197.170.90, 3.33.182.45 ``` ## Related Meli-family domains (from cert SANs, outside input zones) mercadolibre.com.bo mercadolibre.com.co mercadolibre.com.do mercadolibre.com.ec mercadolibre.com.gt mercadolibre.com.hn mercadolibre.com.mx mercadolibre.com.ni mercadolibre.com.pa mercadolibre.com.pe mercadolibre.com.py mercadolibre.com.sv mercadolibre.com.uy mercadolibre.com.ve ## 6. Issuer distribution (ctlogs.dev) ``` 58 Amazon 30 DigiCert Inc 12 Google Trust Services ```
Files
- BUGBOUNTY_REPORT.md
- REPORT.md
- cert_finder.py
- certs/certspotter.json
- certs/crt_sh.json
- certs/ctlogs_dev.json
- certs/probe_certspotter.json
- certs/probe_crtsh.json
- dns/dns_resolution.json
- dns/dns_resolution.txt
- dns/unique_ips.txt
- input_domains.txt
- mercadolibre-ddgdork.txt
- subdomains/httpx_results.txt
- subdomains/related_domains.txt
- subdomains/subdomains_merged.txt
- subdomains/wildcards_found.txt