ig-helpteam.ga Open in urlscan Pro
2606:4700:3032::6812:2276  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response ig-helpteam.ga/	8 KB 3 KB	382ms 340ms	Document text/html	2606:4700:3032::6812:2276 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ig-helpteam.ga/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::6812:2276 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 926d8fc67747d94f4688a8a3fd904f211d9f149f57d9dfcbd802067a7c63019a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers :method GET :authority ig-helpteam.ga :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 17 Dec 2020 01:38:23 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=d39020d23584104a7049280279b83fb501608169102; expires=Sat, 16-Jan-21 01:38:22 GMT; path=/; domain=.ig-helpteam.ga; HttpOnly; SameSite=Lax x-xss-protection 1; mode=block x-content-type-options nosniff x-request-id 8f484443c38d61d5d15908b1b1c3da9e cf-cache-status DYNAMIC cf-request-id 070ff2357d00002b16188b4000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ALvp3xc65n2urWx%2FggVn4OPPQOBliY%2BA0VD6%2BU%2BlEFFCIFLabk5uke1BPA2fWlwpDR526XbfMFpdlcN96ygEuI0XLmPUCEtMkoybskfF97LJ1dGUBB436waWLQ%3D%3D"}],"group":"cf-nel","max_age":604800} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 602cec9bf8052b16-FRA content-encoding br
GET H2	200	sKqXcB7zDP7N-6yY75yXsKOC97B-g-pZSdkWFTKh02EVUCA277wXPS-5JGPMeRBHAKdRtnZv=s0-d-e1-ft ci4.googleusercontent.com/proxy/	785 KB 786 KB	1250ms 1224ms	Image image/gif	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ci4.googleusercontent.com/proxy/sKqXcB7zDP7N-6yY75yXsKOC97B-g-pZSdkWFTKh02EVUCA277wXPS-5JGPMeRBHAKdRtnZv=s0-d-e1-ft Requested by Host: ig-helpteam.ga URL: https://ig-helpteam.ga/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software fife / Resource Hash 34b405bf58c292a06f7e755b46ff12cfaf230d5f4a0f6368298c63e1c76f25fc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://ig-helpteam.ga/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 17 Dec 2020 01:38:24 GMT x-content-type-options nosniff server fife vary Origin content-type image/gif access-control-allow-origin * access-control-expose-headers Content-Length cache-control max-age=31556926 content-disposition attachment;filename="unnamed.gif" timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 803583 x-xss-protection 0
GET H2	200	1nzWmt3zgNYueUHtay9q_z3jdPD7IfplMhToVaTNHeqFGmzl-OeOo0KjN7EE5gAllJPpdiiz=s0-d-e1-ft ci6.googleusercontent.com/proxy/	304 KB 305 KB	846ms 806ms	Image image/gif	2a00:1450:4001:80b::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ci6.googleusercontent.com/proxy/1nzWmt3zgNYueUHtay9q_z3jdPD7IfplMhToVaTNHeqFGmzl-OeOo0KjN7EE5gAllJPpdiiz=s0-d-e1-ft Requested by Host: ig-helpteam.ga URL: https://ig-helpteam.ga/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software fife / Resource Hash 766eba871c4341d668c6f9e901b97daedaf7e11dca64e2695ff8811a4ba1e318 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://ig-helpteam.ga/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 17 Dec 2020 01:38:23 GMT x-content-type-options nosniff server fife vary Origin content-type image/gif access-control-allow-origin * access-control-expose-headers Content-Length cache-control max-age=31556926 content-disposition attachment;filename="unnamed.gif" timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 311800 x-xss-protection 0
GET H2	200	footer-powered-by-000webhost-white2.png cdn.000webhost.com/000webhost/logo/	2 KB 2 KB	44ms 18ms	Image image/webp	2606:4700::6812:6c08 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.000webhost.com/000webhost/logo/footer-powered-by-000webhost-white2.png Requested by Host: ig-helpteam.ga URL: https://ig-helpteam.ga/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:6c08 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 86f2673ec74a632865109a76b2232f4f5b3587daa219e07a17ef1d9c76a0fda5 Security Headers Name Value Strict-Transport-Security max-age=2592000 X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://ig-helpteam.ga/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 17 Dec 2020 01:38:23 GMT x-content-type-options nosniff cf-cache-status HIT age 2808 cf-polished origFmt=png, origSize=2046 content-disposition inline; filename="footer-powered-by-000webhost-white2.webp" cf-bgj imgq:100,h2pri x-hostinger-datacenter srv alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 1696 x-xss-protection 1; mode=block last-modified Wed, 16 Dec 2020 13:34:28 GMT server cloudflare x-frame-options sameorigin etag "5fda0ce4-7fe" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=2592000 content-type image/webp vary Accept cache-control public, max-age=14400 x-hostinger-node nl-srv-cdn2 cf-request-id 070ff236fc00001782fd86b000000001 accept-ranges bytes cf-ray 602cec9e59a71782-FRA expires Thu, 17 Dec 2020 05:38:23 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Instagram (Social Network)

28 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| getCookie undefined| wordpressAdminBody object| notification object| hostingerLogo undefined| mainContent undefined| googleFont undefined| css undefined| style undefined| sheet undefined| button undefined| link undefined| mainContentHolder undefined| h1Tag undefined| h2Tag undefined| paragraph undefined| list undefined| org_html undefined| new_html undefined| saleImage

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.ig-helpteam.ga/	1970-01-19 15:26:01	Name: __cfduid Value: d39020d23584104a7049280279b83fb501608169102

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.000webhost.com
ci4.googleusercontent.com
ci6.googleusercontent.com
ig-helpteam.ga
2606:4700:3032::6812:2276
2606:4700::6812:6c08
2a00:1450:4001:80b::2001
2a00:1450:4001:81e::2001
34b405bf58c292a06f7e755b46ff12cfaf230d5f4a0f6368298c63e1c76f25fc
766eba871c4341d668c6f9e901b97daedaf7e11dca64e2695ff8811a4ba1e318
86f2673ec74a632865109a76b2232f4f5b3587daa219e07a17ef1d9c76a0fda5
926d8fc67747d94f4688a8a3fd904f211d9f149f57d9dfcbd802067a7c63019a