instagramhelpcoppiyrght.com Open in urlscan Pro
66.85.73.154 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://instagramhelpcoppiyrght.com/mailconfirmation.php
Submission Tags: @ipnigh
Submission: On May 13 via api (May 13th 2020, 10:22:37 am UTC) from GB

Summary HTTP 10 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 8 IPs in 3 countries across 8 domains to perform 10 HTTP transactions. The main IP is 66.85.73.154, located in Kansas City, United States and belongs to JOESDATACENTER, US. The main domain is instagramhelpcoppiyrght.com.

This is the only time instagramhelpcoppiyrght.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Instagram (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
1	66.85.73.154 66.85.73.154	19969 (JOESDATAC...) (JOESDATACENTER)
1	2a00:1450:400... 2a00:1450:4001:816::200a	15169 (GOOGLE) (GOOGLE)
3 3	139.59.135.71 139.59.135.71	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
3	46.101.215.156 46.101.215.156	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	51.178.88.195 51.178.88.195	16276 (OVH) (OVH)
1	160.153.128.13 160.153.128.13	21501 (GODADDY-AMS) (GODADDY-AMS)
1	198.37.116.27 198.37.116.27	17216 (DC74-AS) (DC74-AS)
1	2406:da00:ff0... 2406:da00:ff00::23a8:5bba	14618 (AMAZON-AES) (AMAZON-AES)
1	198.37.116.16 198.37.116.16	17216 (DC74-AS) (DC74-AS)
10	8

1 66.85.73.154 (Kansas City, United States)

ASN19969 (JOESDATACENTER, US)

instagramhelpcoppiyrght.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:816::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 139.59.135.71 (Frankfurt am Main, Germany) 3 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

newbigdata.science	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 46.101.215.156 (Frankfurt am Main, Germany)

ASN14061 (DIGITALOCEAN-ASN, US)

www.croxyproxy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.178.88.195 (France)

ASN16276 (OVH, FR)
PTR: i.ibb.co

image.ibb.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 160.153.128.13 (Scottsdale, United States)

ASN21501 (GODADDY-AMS, DE)
PTR: ip-160-153-128-13.ip.secureserver.net

www.free-icons-download.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.37.116.27 (La Jolla, United States)

ASN17216 (DC74-AS, US)
PTR: 116.37.198-27.dc74.net

ads.mgmt.somee.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2406:da00:ff00::23a8:5bba (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

instagram.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.37.116.16 (La Jolla, United States)

ASN17216 (DC74-AS, US)
PTR: 116.37.198-16.dc74.net

vb1700.mgmt.somee.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	croxyproxy.com www.croxyproxy.com
3	newbigdata.science 3 redirects newbigdata.science	612 B
2	somee.com ads.mgmt.somee.com vb1700.mgmt.somee.com	2 KB
1	instagram.com instagram.com	128 KB
1	free-icons-download.net www.free-icons-download.net	45 KB
1	ibb.co image.ibb.co	3 KB
1	googleapis.com ajax.googleapis.com	30 KB
1	instagramhelpcoppiyrght.com instagramhelpcoppiyrght.com	57 KB
10	8

	Domain	Requested by
3	www.croxyproxy.com	instagramhelpcoppiyrght.com
3	newbigdata.science	3 redirects
1	vb1700.mgmt.somee.com	instagramhelpcoppiyrght.com
1	instagram.com	instagramhelpcoppiyrght.com
1	ads.mgmt.somee.com	instagramhelpcoppiyrght.com
1	www.free-icons-download.net	instagramhelpcoppiyrght.com
1	image.ibb.co	instagramhelpcoppiyrght.com
1	ajax.googleapis.com	instagramhelpcoppiyrght.com
1	instagramhelpcoppiyrght.com
10	9

This site contains links to these domains. Also see Links.

Domain
newbigdata.science
somee.com

Subject Issuer	Validity	Valid
upload.video.google.com GTS CA 1O1	`2020-04-28` - `2020-07-21`	3 months	crt.sh
c.cpfrx.info Let's Encrypt Authority X3	`2020-05-10` - `2020-08-08`	3 months	crt.sh
ibb.co Let's Encrypt Authority X3	`2020-03-29` - `2020-06-27`	3 months	crt.sh
*.instagram.com DigiCert SHA2 High Assurance Server CA	`2020-03-22` - `2020-06-20`	3 months	crt.sh

This page contains 3 frames:

Primary Page: http://instagramhelpcoppiyrght.com/mailconfirmation.php
Frame ID: FC3C69D1AC79BC0B858300B7A914588C
Requests: 8 HTTP requests in this frame

Frame: https://www.croxyproxy.com/
Frame ID: A968D1F5643A222C404C7E0AA3C299FA
Requests: 1 HTTP requests in this frame

Frame: https://www.croxyproxy.com/
Frame ID: 5FCDFD7840E06FC1D312BAAC1210B5DD
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Windows Server (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

IIS (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

10
Requests

60 %
HTTPS

22 %
IPv6

8
Domains

9
Subdomains

8
IPs

3
Countries

265 kB
Transfer

428 kB
Size

13
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://newbigdata.science/?__cpo=aHR0cHM6Ly93d3cuaW5zdGFncmFtLmNvbQ
Title: Instagram

Search URL Search Domain Scan URL

URL: http://somee.com/
Title: Web hosting by Somee.com

Search URL Search Domain Scan URL

URL: http://somee.com/VirtualServer.aspx
Title: Hosted Windows Virtual Server. 2.5GHz CPU, 1.5GB RAM, 60GB SSD. Try it now for $1!

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://newbigdata.science/__cpa.cp.js?dummy=bb38f5627f85538afdae92980142c88c&__cpo=1 HTTP 301
https://www.croxyproxy.com/

Request Chain 5

https://newbigdata.science/connect/xd_arbiter/r/qMnGlIs-JNW.js?version=42&__cpo=aHR0cHM6Ly9zdGF0aWN4eC5mYWNlYm9vay5jb20 HTTP 301
https://www.croxyproxy.com/

Request Chain 6

https://newbigdata.science/connect/ping?client_id=124024574287414&domain=www.instagram.com&origin=1&redirect_uri=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2FqMnGlIs-JNW.js%3Fversion%3D42%23cb%3Df1f19c0950ec264%26domain%3Dwww.instagram.com%26origin%3Dhttps%253A%252F%252Fwww.instagram.com%252Ff59a022dfc20ec%26relation%3Dparent&response_type=token%2Csigned_request%2Ccode&sdk=joey&version=v2.2&__cpo=aHR0cHM6Ly93d3cuZmFjZWJvb2suY29t HTTP 301
https://www.croxyproxy.com/

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request mailconfirmation.php Show response
instagramhelpcoppiyrght.com/ 163 KB
57 KB 402ms
268ms Document
text/html 66.85.73.154
JOESDATACENTER

General

Check archive.org

Show headers Download Go to

Full URL: http://instagramhelpcoppiyrght.com/mailconfirmation.php
Protocol: HTTP/1.1
Server: 66.85.73.154 Kansas City, United States, ASN19969 (JOESDATACENTER, US),
Reverse DNS
Software: Microsoft-IIS/8.0 / PHP/5.4.0 ASP.NET
Resource Hash: caa88a4c98e8405d87f50674ac3100adf1774147c5d6a0bd60e973aae8da0135

Request headers

Host: instagramhelpcoppiyrght.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: text/html
Content-Encoding: gzip
Vary: Accept-Encoding
Server: Microsoft-IIS/8.0
X-Powered-By: PHP/5.4.0 ASP.NET
Date: Wed, 13 May 2020 10:22:18 GMT
Content-Length: 57816

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ 85 KB
30 KB 26ms
6ms Script
text/javascript 2a00:1450:4001:816::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js

Requested by

Host: instagramhelpcoppiyrght.com
URL: http://instagramhelpcoppiyrght.com/mailconfirmation.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://instagramhelpcoppiyrght.com/mailconfirmation.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 13 May 2020 04:44:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 20288
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30399
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 13 May 2021 04:44:11 GMT

GET
H/1.1

200
OK

/ Show response
www.croxyproxy.com/
Redirect Chain

https://newbigdata.science/__cpa.cp.js?dummy=bb38f5627f85538afdae92980142c88c&__cpo=1
https://www.croxyproxy.com/

0
0

114ms
44ms

Script
text/html

46.101.215.156
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.croxyproxy.com/
Requested by: Host: instagramhelpcoppiyrght.com
URL: http://instagramhelpcoppiyrght.com/mailconfirmation.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.101.215.156 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://instagramhelpcoppiyrght.com/mailconfirmation.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

access-control-allow-origin: https://www.croxyproxy.com

Redirect headers

Location: https://www.croxyproxy.com/
Date: Wed, 13 May 2020 10:22:19 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 logo.png
image.ibb.co/fjkP4z/ 3 KB
3 KB 92ms
30ms Image
image/png 51.178.88.195
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image.ibb.co/fjkP4z/logo.png
Requested by: Host: instagramhelpcoppiyrght.com
URL: http://instagramhelpcoppiyrght.com/mailconfirmation.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 51.178.88.195 , France, ASN16276 (OVH, FR),
Reverse DNS: i.ibb.co
Software: nginx /
Resource Hash: 8d462c8f2d10700b31c8263fca0da5b11f0921a99eb15c1c3cebc1e37889b1cc

Request headers

Referer: http://instagramhelpcoppiyrght.com/mailconfirmation.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 13 May 2020 10:22:20 GMT
last-modified: Sun, 16 Sep 2018 15:18:11 GMT
server: nginx
status: 200
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 3273
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK mail-logo-icon-24577.png
www.free-icons-download.net/images/ 44 KB
45 KB 82ms
37ms Image
image/png 160.153.128.13
GODADDY-AMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.free-icons-download.net/images/mail-logo-icon-24577.png
Requested by: Host: instagramhelpcoppiyrght.com
URL: http://instagramhelpcoppiyrght.com/mailconfirmation.php
Protocol: HTTP/1.1
Server: 160.153.128.13 Scottsdale, United States, ASN21501 (GODADDY-AMS, DE),
Reverse DNS: ip-160-153-128-13.ip.secureserver.net
Software: Apache /
Resource Hash: 8fa71b1d50fbf39944ce9d7883ef00a65f7fbed52a5becef60947570ea485527

Request headers

Referer: http://instagramhelpcoppiyrght.com/mailconfirmation.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 13 May 2020 10:22:20 GMT
Last-Modified: Fri, 18 Dec 2015 00:59:58 GMT
Server: Apache
ETag: "84b38ca-b13f-52721a8813f80"
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: image/png
Keep-Alive: timeout=5
Content-Length: 45375

GET
H/1.1 200
OK WholeInsert4.js Show response
ads.mgmt.somee.com/serveimages/ad2/ 4 KB
2 KB 362ms
222ms Script
application/javascript 198.37.116.27
DC74-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://ads.mgmt.somee.com/serveimages/ad2/WholeInsert4.js
Requested by: Host: instagramhelpcoppiyrght.com
URL: http://instagramhelpcoppiyrght.com/mailconfirmation.php
Protocol: HTTP/1.1
Server: 198.37.116.27 La Jolla, United States, ASN17216 (DC74-AS, US),
Reverse DNS: 116.37.198-27.dc74.net
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: f0847b313c3f0714d708fd7402e2babc6e7db1d445819859c6aaaf4b743539c5

Request headers

Referer: http://instagramhelpcoppiyrght.com/mailconfirmation.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 13 May 2020 10:22:14 GMT
Content-Encoding: gzip
Last-Modified: Tue, 27 Dec 2016 18:04:08 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
ETag: "01c419e6b60d21:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Length: 1533

GET
H/1.1

200
OK

/
www.croxyproxy.com/ Frame A968
Redirect Chain

https://newbigdata.science/connect/xd_arbiter/r/qMnGlIs-JNW.js?version=42&__cpo=aHR0cHM6Ly9zdGF0aWN4eC5mYWNlYm9vay5jb20
https://www.croxyproxy.com/

0
0

104ms
48ms

Document
text/html

46.101.215.156
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.croxyproxy.com/

Requested by

Host: instagramhelpcoppiyrght.com
URL: http://instagramhelpcoppiyrght.com/mailconfirmation.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

46.101.215.156 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Apache /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-eval' 'unsafe-inline'; object-src https:
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

Host: www.croxyproxy.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: http://instagramhelpcoppiyrght.com/mailconfirmation.php
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://instagramhelpcoppiyrght.com/mailconfirmation.php

Response headers

Date: Wed, 13 May 2020 10:22:20 GMT
Server: Apache
access-control-allow-origin: https://www.croxyproxy.com
strict-transport-security: max-age=31536000; includeSubDomains
x-xss-protection: 1
x-content-type-options: nosniff
content-security-policy: default-src https: data: 'unsafe-eval' 'unsafe-inline'; object-src https:
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 5795
Connection: close
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Wed, 13 May 2020 10:22:20 GMT
Server: Apache
Location: https://www.croxyproxy.com/
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

GET
H/1.1

200
OK

/
www.croxyproxy.com/ Frame 5FCD
Redirect Chain

https://newbigdata.science/connect/ping?client_id=124024574287414&domain=www.instagram.com&origin=1&redirect_uri=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2FqMnGlIs-JNW.js%3Fve...
https://www.croxyproxy.com/

0
0

106ms
47ms

Document
text/html

46.101.215.156
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.croxyproxy.com/

Requested by

Host: instagramhelpcoppiyrght.com
URL: http://instagramhelpcoppiyrght.com/mailconfirmation.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

46.101.215.156 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Apache /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-eval' 'unsafe-inline'; object-src https:
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

Host: www.croxyproxy.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: http://instagramhelpcoppiyrght.com/mailconfirmation.php
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://instagramhelpcoppiyrght.com/mailconfirmation.php

Response headers

Date: Wed, 13 May 2020 10:22:20 GMT
Server: Apache
access-control-allow-origin: https://www.croxyproxy.com
strict-transport-security: max-age=31536000; includeSubDomains
x-xss-protection: 1
x-content-type-options: nosniff
content-security-policy: default-src https: data: 'unsafe-eval' 'unsafe-inline'; object-src https:
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 5795
Connection: close
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Wed, 13 May 2020 10:22:20 GMT
Server: Apache
Location: https://www.croxyproxy.com/
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

GET
H2 200 2115b50d229d.png
instagram.com/static/bundles/base/sprite_core.png/ 128 KB
128 KB 1363ms
1165ms Image
image/png 2406:da00:ff00::23a8:5bba
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://instagram.com/static/bundles/base/sprite_core.png/2115b50d229d.png
Requested by: Host: instagramhelpcoppiyrght.com
URL: http://instagramhelpcoppiyrght.com/mailconfirmation.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2406:da00:ff00::23a8:5bba Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: 405e90473f7ac27061af0027ea856fe80c6f71310edb768f23f774c4088eb8c8

Request headers

Referer: https://instagram.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 13 May 2020 10:22:21 GMT
content-encoding: br
status: 200
etag: "2115b50d229d"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
edge-control: max-age=1209600, no-transform
cache-control: public,max-age=31536000,immutable
content-length: 130927

GET
H/1.1 200
OK DOProcessAdClick.aspx
vb1700.mgmt.somee.com/dzwebsvc/ 0
203 B 261ms
248ms Image
image/png 198.37.116.16
DC74-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://vb1700.mgmt.somee.com/dzwebsvc/DOProcessAdClick.aspx?cid=someehost&ct=h&p=0&rn=0.856487432402049&c=1&vr=adwords&r=&fr=0&pg=http%3A//instagramhelpcoppiyrght.com/mailconfirmation.php&go=
Requested by: Host: instagramhelpcoppiyrght.com
URL: http://instagramhelpcoppiyrght.com/mailconfirmation.php
Protocol: HTTP/1.1
Server: 198.37.116.16 La Jolla, United States, ASN17216 (DC74-AS, US),
Reverse DNS: 116.37.198-16.dc74.net
Software: Microsoft-IIS/8.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://instagramhelpcoppiyrght.com/mailconfirmation.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 13 May 2020 10:22:16 GMT
Cache-Control: private
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Length: 0
Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Instagram (Social Network)

28 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

13 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.addthis.com/	1970-01-19 18:59:39	Name: loc Value: MDAwMDBFVUJFMDAyMzA5MTg0NTAwMDAwMDBDSA==
.userreport.com/	1970-01-19 18:15:01	Name: __ur_dc Value: 1589365341641
.userreport.com/	1970-01-19 18:15:01	Name: __ur_i Value: 0
.userreport.com/	1970-01-19 18:15:01	Name: __bpn_uid Value: 26387c90-269d-45ac-9be3-2d2fee8d15a2
.doubleclick.net/	1970-01-19 18:51:01	Name: IDE Value: AHWqTUnhAe_z_vhsOEHa3mvs2YNtiy8z_cM0K_Ixm2RcOvXgUfb94aIWr8fjBgb5
.addthis.com/	1970-01-19 18:59:39	Name: uvc Value: 2%7C20
cdn.blockaway.net/	1970-01-19 09:29:27	Name: __atuvs Value: 5ebbca5d6d899735001
cdn.blockaway.net/	1970-01-19 18:59:39	Name: __atuvc Value: 2%7C20
.croxyproxy.com/	1970-01-19 09:30:51	Name: _gid Value: GA1.2.1373131080.1589365341
.croxyproxy.com/	1970-01-19 09:29:25	Name: _gat_gtag_UA_111548442_4 Value: 1
.croxyproxy.com/	1970-01-19 09:29:25	Name: _gat_gtag_UA_111548442_12 Value: 1
.croxyproxy.com/	1970-01-20 03:00:37	Name: _ga Value: GA1.2.1017966767.1589365341
instagramhelpcoppiyrght.com/	1969-12-31 23:59:59	Name: b Value: b

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads.mgmt.somee.com
ajax.googleapis.com
image.ibb.co
instagram.com
instagramhelpcoppiyrght.com
newbigdata.science
vb1700.mgmt.somee.com
www.croxyproxy.com
www.free-icons-download.net
139.59.135.71
160.153.128.13
198.37.116.16
198.37.116.27
2406:da00:ff00::23a8:5bba
2a00:1450:4001:816::200a
46.101.215.156
51.178.88.195
66.85.73.154
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
405e90473f7ac27061af0027ea856fe80c6f71310edb768f23f774c4088eb8c8
8d462c8f2d10700b31c8263fca0da5b11f0921a99eb15c1c3cebc1e37889b1cc
8fa71b1d50fbf39944ce9d7883ef00a65f7fbed52a5becef60947570ea485527
caa88a4c98e8405d87f50674ac3100adf1774147c5d6a0bd60e973aae8da0135
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f0847b313c3f0714d708fd7402e2babc6e7db1d445819859c6aaaf4b743539c5

instagramhelpcoppiyrght.com Open in urlscan Pro 66.85.73.154 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

10 Requests

60 %HTTPS

22 %IPv6

8 Domains

9 Subdomains

8 IPs

3 Countries

265 kBTransfer

428 kBSize

13 Cookies

3 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

28 JavaScript Global Variables

13 Cookies

Indicators

instagramhelpcoppiyrght.com Open in urlscan Pro
66.85.73.154 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

60 %
HTTPS

22 %
IPv6

8
Domains

9
Subdomains

8
IPs

3
Countries

265 kB
Transfer

428 kB
Size

13
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!