instagramcerts.com Open in urlscan Pro
20.57.169.216 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://instagramcerts.com/
Effective URL:
https://instagramcerts.com/
Submission Tags: @phishunt_io
Submission: On February 17 via api (February 17th 2021, 1:15:52 am UTC) from ES

Summary HTTP 18 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 18 HTTP transactions. The main IP is 20.57.169.216, located in United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is instagramcerts.com.
TLS certificate: Issued by R3 on February 12th 2021. Valid for: 3 months.

This is the only time instagramcerts.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Instagram (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
1 13	20.57.169.216 20.57.169.216	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	168.119.145.176 168.119.145.176	24940 (HETZNER-AS) (HETZNER-AS)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
18	4

13 20.57.169.216 (United States) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

instagramcerts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f01c:8012:face:b00c:0:3 (United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 168.119.145.176 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.176.145.119.168.clients.your-server.de

i.imgyukle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	instagramcerts.com 1 redirects instagramcerts.com	27 KB
3	facebook.net connect.facebook.net	131 KB
2	facebook.com www.facebook.com	557 B
1	imgyukle.com i.imgyukle.com	31 KB
18	4

	Domain	Requested by
13	instagramcerts.com	1 redirects instagramcerts.com
3	connect.facebook.net	instagramcerts.com connect.facebook.net
2	www.facebook.com	instagramcerts.com
1	i.imgyukle.com	instagramcerts.com
18	4

This site contains no links.

Subject Issuer	Validity	Valid
instagramcerts.com R3	`2021-02-12` - `2021-05-13`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-12-22` - `2021-03-21`	3 months	crt.sh
imgyukle.com R3	`2020-12-05` - `2021-03-05`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://instagramcerts.com/
Frame ID: 668B5F9B9158EF8EF5E673B14B5D86DC
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://instagramcerts.com/ HTTP 301
https://instagramcerts.com/ Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

18
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

189 kB
Transfer

590 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://instagramcerts.com/ HTTP 301
https://instagramcerts.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
instagramcerts.com/
Redirect Chain

http://instagramcerts.com/
https://instagramcerts.com/

102 KB
26 KB

782ms
378ms

Document
text/html

20.57.169.216
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://instagramcerts.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

20.57.169.216 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

nginx / PHP/7.4.15 PleskLin

Resource Hash

b71dbff70770f49bcb68afa66be8ca02f667824e0c9dfee83f10466175964858

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:method: GET
:authority: instagramcerts.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

server: nginx
date: Wed, 17 Feb 2021 01:15:35 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.4.15 PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
content-encoding: br

Redirect headers

Server: nginx
Date: Wed, 17 Feb 2021 01:15:34 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: https://instagramcerts.com/

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 91 KB
24 KB 18ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: instagramcerts.com
URL: https://instagramcerts.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9e7ea2b4ba8e2bcc4a964d6192e4671dc5f6863a1c7e35b52b229a3c1e67a68d

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://instagramcerts.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 23762
x-fb-rlafr: 0
pragma: public
x-fb-debug: /dbteHJQvCoKu5FpoVz0I2n1LQnHooEWBMyJsV5wm46AkR0IFGWaCi7KaEHTnw4SvE56beNmB+P7wQQ6DJSv3w==
x-fb-trip-id: 686109401
x-frame-options: DENY
date: Wed, 17 Feb 2021 01:15:35 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 404 1425767024389221
instagramcerts.com/files/ 0
0 206ms
206ms Script
text/html 20.57.169.216
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://instagramcerts.com/files/1425767024389221

Requested by

Host: instagramcerts.com
URL: https://instagramcerts.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

20.57.169.216 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Referer: https://instagramcerts.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 17 Feb 2021 01:15:35 GMT
content-encoding: br
last-modified: Sat, 13 Feb 2021 00:17:35 GMT
server: nginx
etag: W/"328-5bb2cadfa9b4d"
strict-transport-security: max-age=15768000; includeSubDomains
content-type: text/html

GET
H2 404 fbevents.js.indir
instagramcerts.com/files/ 0
0 205ms
204ms Script
text/html 20.57.169.216
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://instagramcerts.com/files/fbevents.js.indir

Requested by

Host: instagramcerts.com
URL: https://instagramcerts.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

20.57.169.216 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Referer: https://instagramcerts.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 17 Feb 2021 01:15:35 GMT
content-encoding: br
last-modified: Sat, 13 Feb 2021 00:17:35 GMT
server: nginx
etag: W/"328-5bb2cadfa9b4d"
strict-transport-security: max-age=15768000; includeSubDomains
content-type: text/html

GET
H2 404 1425767024389221(1)
instagramcerts.com/files/ 0
0 211ms
209ms Script
text/html 20.57.169.216
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://instagramcerts.com/files/1425767024389221(1)

Requested by

Host: instagramcerts.com
URL: https://instagramcerts.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

20.57.169.216 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Referer: https://instagramcerts.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 17 Feb 2021 01:15:35 GMT
content-encoding: br
last-modified: Sat, 13 Feb 2021 00:17:35 GMT
server: nginx
etag: W/"328-5bb2cadfa9b4d"
strict-transport-security: max-age=15768000; includeSubDomains
content-type: text/html

GET
H2 404 fbevents.js(1).indir
instagramcerts.com/files/ 0
0 210ms
209ms Script
text/html 20.57.169.216
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://instagramcerts.com/files/fbevents.js(1).indir

Requested by

Host: instagramcerts.com
URL: https://instagramcerts.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

20.57.169.216 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Referer: https://instagramcerts.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 17 Feb 2021 01:15:35 GMT
content-encoding: br
last-modified: Sat, 13 Feb 2021 00:17:35 GMT
server: nginx
etag: W/"328-5bb2cadfa9b4d"
strict-transport-security: max-age=15768000; includeSubDomains
content-type: text/html

GET
H2 200 1425767024389221 Show response
connect.facebook.net/signals/config/ 124 KB
38 KB 7ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1425767024389221?v=2.8.24&r=stable

Requested by

Host: instagramcerts.com
URL: https://instagramcerts.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aadb0ba0a945d6f72a1918fc26f706686a7f1ecb5bf218264ccb0e19bdc21445

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://instagramcerts.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 38150
x-fb-rlafr: 0
pragma: public
x-fb-debug: Ldw67hRzCOMwYvLMRwhr1PoS/PdUTmRp74lRYfmfhw4LK35CdSrQ5+JYgza+VQqnJo+H+kj14k/S9I6Onb+5/g==
x-fb-trip-id: 686109401
x-frame-options: DENY
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Wed, 17 Feb 2021 01:15:35 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-content-id: 2184816134
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 V7jZT8.jpg
i.imgyukle.com/2020/01/30/ 30 KB
31 KB 171ms
55ms Image
image/jpeg 168.119.145.176
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgyukle.com/2020/01/30/V7jZT8.jpg

Requested by

Host: instagramcerts.com
URL: https://instagramcerts.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

168.119.145.176 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.176.145.119.168.clients.your-server.de

Software

nginx / PleskLin

Resource Hash

c7b1f44cddfc09535214aa545c7e6e6eb96af4cbb726f00194db143ded796240

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://instagramcerts.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 17 Feb 2021 01:15:35 GMT
referrer-policy: origin
last-modified: Wed, 29 Jan 2020 21:00:00 GMT
server: nginx
x-powered-by: PleskLin
etag: "5e31f250-792e"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
x-xss-protection: 1; mode=block
x-permitted-cross-domain-policies: master-only
feature-policy: geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;
content-security-policy: frame-ancestors 'self';
accept-ranges: bytes
content-length: 31022
x-content-type-options: nosniff

GET
H2 404 6514c5e08593.js.indir
instagramcerts.com/files/ 0
0 216ms
213ms Script
text/html 20.57.169.216
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://instagramcerts.com/files/6514c5e08593.js.indir

Requested by

Host: instagramcerts.com
URL: https://instagramcerts.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

20.57.169.216 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Referer: https://instagramcerts.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 17 Feb 2021 01:15:35 GMT
content-encoding: br
last-modified: Sat, 13 Feb 2021 00:17:35 GMT
server: nginx
etag: W/"328-5bb2cadfa9b4d"
strict-transport-security: max-age=15768000; includeSubDomains
content-type: text/html

GET
H2 404 fc3c22cf2d67.js.indir
instagramcerts.com/files/ 0
0 215ms
213ms Script
text/html 20.57.169.216
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://instagramcerts.com/files/fc3c22cf2d67.js.indir

Requested by

Host: instagramcerts.com
URL: https://instagramcerts.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

20.57.169.216 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Referer: https://instagramcerts.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 17 Feb 2021 01:15:35 GMT
content-encoding: br
last-modified: Sat, 13 Feb 2021 00:17:35 GMT
server: nginx
etag: W/"328-5bb2cadfa9b4d"
strict-transport-security: max-age=15768000; includeSubDomains
content-type: text/html

GET
H2 404 f1abf980aaf5.js.indir
instagramcerts.com/files/ 0
0 211ms
209ms Script
text/html 20.57.169.216
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://instagramcerts.com/files/f1abf980aaf5.js.indir

Requested by

Host: instagramcerts.com
URL: https://instagramcerts.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

20.57.169.216 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Origin: https://instagramcerts.com
Referer: https://instagramcerts.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 17 Feb 2021 01:15:35 GMT
content-encoding: br
last-modified: Sat, 13 Feb 2021 00:17:35 GMT
server: nginx
etag: W/"328-5bb2cadfa9b4d"
strict-transport-security: max-age=15768000; includeSubDomains
content-type: text/html

GET
H2 404 8d4b99281427.js.indir
instagramcerts.com/files/ 0
0 210ms
208ms Script
text/html 20.57.169.216
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://instagramcerts.com/files/8d4b99281427.js.indir

Requested by

Host: instagramcerts.com
URL: https://instagramcerts.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

20.57.169.216 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Origin: https://instagramcerts.com
Referer: https://instagramcerts.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 17 Feb 2021 01:15:35 GMT
content-encoding: br
last-modified: Sat, 13 Feb 2021 00:17:35 GMT
server: nginx
etag: W/"328-5bb2cadfa9b4d"
strict-transport-security: max-age=15768000; includeSubDomains
content-type: text/html

GET
H2 404 fc3c22cf2d67.js.indir
instagramcerts.com/files/ 0
0 206ms
206ms Script
text/html 20.57.169.216
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://instagramcerts.com/files/fc3c22cf2d67.js.indir

Requested by

Host: instagramcerts.com
URL: https://instagramcerts.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

20.57.169.216 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Referer: https://instagramcerts.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 17 Feb 2021 01:15:35 GMT
content-encoding: br
last-modified: Sat, 13 Feb 2021 00:17:35 GMT
server: nginx
etag: W/"328-5bb2cadfa9b4d"
strict-transport-security: max-age=15768000; includeSubDomains
content-type: text/html

GET
H2 404 f1abf980aaf5.js.indir
instagramcerts.com/files/ 0
0 207ms
207ms Script
text/html 20.57.169.216
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://instagramcerts.com/files/f1abf980aaf5.js.indir

Requested by

Host: instagramcerts.com
URL: https://instagramcerts.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

20.57.169.216 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Origin: https://instagramcerts.com
Referer: https://instagramcerts.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 17 Feb 2021 01:15:36 GMT
content-encoding: br
last-modified: Sat, 13 Feb 2021 00:17:35 GMT
server: nginx
etag: W/"328-5bb2cadfa9b4d"
strict-transport-security: max-age=15768000; includeSubDomains
content-type: text/html

GET
H2 404 8d4b99281427.js.indir
instagramcerts.com/files/ 0
0 206ms
206ms Script
text/html 20.57.169.216
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://instagramcerts.com/files/8d4b99281427.js.indir

Requested by

Host: instagramcerts.com
URL: https://instagramcerts.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

20.57.169.216 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Origin: https://instagramcerts.com
Referer: https://instagramcerts.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 17 Feb 2021 01:15:36 GMT
content-encoding: br
last-modified: Sat, 13 Feb 2021 00:17:35 GMT
server: nginx
etag: W/"328-5bb2cadfa9b4d"
strict-transport-security: max-age=15768000; includeSubDomains
content-type: text/html

GET
H2 200 1425767024389221 Show response
connect.facebook.net/signals/config/ 241 KB
70 KB 7ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1425767024389221?v=2.9.33&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

a2d97500e574fef32a2b44ab03b9d63504dcda6e3f2dcbd103d4c6dc2eb94abb

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://instagramcerts.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 71087
x-fb-rlafr: 0
pragma: public
x-fb-debug: 0qv6dnAlGAnzlyY1CLX0bMurPKUnm7iIZE3YjCix8rSKdOOjcj+rbbWIgsx6+HiR9THluuDtX/kc+ULfrYoy5A==
x-fb-trip-id: 686109401
x-frame-options: DENY
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Wed, 17 Feb 2021 01:15:36 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-content-id: 2184816134
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
410 B 18ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1425767024389221&ev=PageView&dl=https%3A%2F%2Finstagramcerts.com%2F&rl=&if=false&ts=1613524536404&sw=1600&sh=1200&v=2.9.33&r=stable&ec=0&o=30&fbp=fb.1.1613524536402.1623885736&it=1613524536369&coo=false&rqm=GET

Requested by

Host: instagramcerts.com
URL: https://instagramcerts.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://instagramcerts.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 17 Feb 2021 01:15:36 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Wed, 17 Feb 2021 01:15:36 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
147 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1425767024389221&ev=Microdata&dl=https%3A%2F%2Finstagramcerts.com%2F&rl=&if=false&ts=1613524537907&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22%5Cn%5CnInstagram%20Help%20Center%5Cn%5Cn%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.33&r=stable&ec=1&o=30&fbp=fb.1.1613524536402.1623885736&it=1613524536369&coo=false&es=automatic&tm=3&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://instagramcerts.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 17 Feb 2021 01:15:37 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Wed, 17 Feb 2021 01:15:37 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Instagram (Social Network)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.instagramcerts.com/	1970-01-19 18:21:40	Name: _fbp Value: fb.1.1613524536402.1623885736

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

connect.facebook.net
i.imgyukle.com
instagramcerts.com
www.facebook.com
168.119.145.176
20.57.169.216
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
9e7ea2b4ba8e2bcc4a964d6192e4671dc5f6863a1c7e35b52b229a3c1e67a68d
a2d97500e574fef32a2b44ab03b9d63504dcda6e3f2dcbd103d4c6dc2eb94abb
aadb0ba0a945d6f72a1918fc26f706686a7f1ecb5bf218264ccb0e19bdc21445
b71dbff70770f49bcb68afa66be8ca02f667824e0c9dfee83f10466175964858
c7b1f44cddfc09535214aa545c7e6e6eb96af4cbb726f00194db143ded796240

instagramcerts.com Open in urlscan Pro 20.57.169.216 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

18 Requests

100 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

189 kBTransfer

590 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

12 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

instagramcerts.com Open in urlscan Pro
20.57.169.216 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

189 kB
Transfer

590 kB
Size

1
Cookies

18 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!