Legitimacy

A gateway should prove itself, not ask to be believed.

Anyone can ship a screen that looks like a bank. The difference is whether the infrastructure behind it survives fifteen minutes of public checking. Everything below can be verified from a terminal or a browser, with no account and no cooperation from us.

1. The host does not rotate

The challenge lives at acs.3dsgate.com and stays there. A large share of look-alike screens are served from a fresh, disposable domain per campaign, which is exactly what defeats recognition.

See the host in use

2. The zone is hardened

Run these and compare them against any other authentication screen you are asked to trust:

dig +short CAA 3dsgate.com                # who may issue certificates
dig +short TXT _dmarc.3dsgate.com         # enforcement, not p=none
dig +short TXT _mta-sts.3dsgate.com       # MTA-STS advertised
curl -s https://mta-sts.3dsgate.com/.well-known/mta-sts.txt

A cloned screen usually has none of the four. Certificate authority pinning in particular almost never appears outside real infrastructure.

DNSSEC is enabled on the zone. The delegation signature (DS) was published to the registry on 28 October 2026 and completes propagation within the TLD's TTL window:

dig +short DS 3dsgate.com

Expected: 2371 13 2 AABDEBDA938316C0C4F894FDD930687B6847B56CA2251D70D9F1745ECA941BCF

3. TLS and browser controls

HSTS with includeSubDomains and preload, a two-year max-age, and no downgrade path to http. The challenge sets a restrictive Content Security Policy and accepts framing only from declared merchant origins through frame-ancestors — the frame cannot be reproduced on an unrelated domain.

curl -sI https://acs.3dsgate.com/otp/ | grep -i 'strict-transport\|content-security'

4. Email from the domain is authenticated

SPF, DKIM and DMARC at p=quarantine with forensic reporting, plus TLS-RPT. A message claiming to come from 3dsgate.com without a valid signature gets quarantined by the receiver, not delivered quietly.

Still worth knowing: 3-D Secure authentication does not send links by itself. A message with a link and a sense of urgency, arriving outside a purchase the buyer actually made, deserves a second look even when the signature is valid.

5. The company resolves

Legal entity	UNNA TRAVEL LTDA
Registry number	42.025.236/0001-22 (CNPJ, verifiable at the Brazilian federal register)
Address	Av. Coronel Colares Moreira, 10, Sala 1109, Renascença, São Luís/MA, 65075-441, Brazil
Role	Operates the authentication layer. Not an issuer, acquirer, scheme or merchant of record.

6. There is someone to write to

Support	[email protected]
Security	[email protected]
Data protection officer	[email protected]
Disclosure policy	/.well-known/security.txt

Support acknowledges in two business days. Security reports are acknowledged the same day.

7. Public status and change history

Incidents, maintenance windows and API availability are published at /status/, including periods where the service degraded. A vendor page that only ever shows green is not evidence of anything.

What the service is not

Not an issuer. It does not decide approval; the issuer does.
Not an acquirer or a PSP. It does not authorise, capture or settle.
Not a scheme or a scheme product. Trademarks belong to their owners.
Not a merchant of record. Billing, delivery and refunds belong to the store.

Being clear about the boundary matters: an authentication screen that pretends to be the bank, the processor and the store at once is claiming more than any real one can.

For cardholders

Landing here from a purchase and want the plain-language version? Por que esta tela explains, in Portuguese, what the screen asks for, what it never asks for, and how to check it.

Read the cardholder guide