instagrambluetickteams.ga Open in urlscan Pro
2606:4700:3034::681f:551a  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://instagrambluetickteams.ga/ Page URL
2. https://instagrambluetickteams.ga/instagram.php Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response instagrambluetickteams.ga/	592 B 991 B	796ms 552ms	Document text/html	2606:4700:3034::681f:551a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://instagrambluetickteams.ga/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::681f:551a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/5.6.38 ASP.NET Resource Hash 068d91bccfd2eac52a3f74190de0c9318212ef1ba775c095f0914e72cd94d81c Request headers :method GET :authority instagrambluetickteams.ga :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 02 Jan 2021 07:00:55 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=dfad09b2079603e927c793974134233681609570854; expires=Mon, 01-Feb-21 07:00:54 GMT; path=/; domain=.instagrambluetickteams.ga; HttpOnly; SameSite=Lax; Secure ARRAffinity=13e13d632ca61dd5d1edfc3055dc06d5598afe950aade10ec4b6f3021223e0a5;Path=/;Domain=instagrambluetickteams.ga vary Accept-Encoding x-powered-by PHP/5.6.38 ASP.NET cf-cache-status DYNAMIC cf-request-id 07637f400600003258be36b000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=uN31FUOvuSbjsiMMGbbP0DAbtx9P5SOK3vI29g43bDJzQWlQHTP7S43y0oSVHxNcKbdAgEeoaXev6lurEpUd3chbppoqDKFsPreMJZgn5QiM2YULQ2DJaoElXATr3c0gBS4kfAwF"}],"group":"cf-nel","max_age":604800} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 60b29b133ab83258-FRA content-encoding br
GET H2	200	instagram-to-gif-8.gif gifimage.net/wp-content/uploads/2017/11/	582 KB 583 KB	110ms 87ms	Image image/gif	2606:4700:3031::681b:a954 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://gifimage.net/wp-content/uploads/2017/11/instagram-to-gif-8.gif Requested by Host: instagrambluetickteams.ga URL: https://instagrambluetickteams.ga/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681b:a954 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cc614c59e963a9b9b2d20b319bed409b9016862b0097f939a60f2fc4323a1a72 Request headers Referer https://instagrambluetickteams.ga/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 02 Jan 2021 07:00:55 GMT cf-cache-status MISS last-modified Sun, 21 Jun 2020 02:14:56 GMT server cloudflare etag "918a5-5a88eb1468b34" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=d7qrKo%2B%2Bbmqjpz53S0Wft8QZfQ4SGgyO%2Bm%2F7WokjhCOAPAtkymK5bj%2FKCpvxO%2B1Ci5sHLE8AwKHihx8L6Akfg5eIaOD2EZMG3NP0eB%2Bqb5IR3prl3wBmqAQ%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif cache-control max-age=31536000 nel {"report_to":"cf-nel","max_age":604800} accept-ranges bytes cf-ray 60b29b16eec14aaf-FRA content-length 596133 cf-request-id 07637f425400004aaffdb9b000000001
GET H2	200	Primary Request instagram.php Show response instagrambluetickteams.ga/	976 B 711 B	555ms 555ms	Document text/html	2606:4700:3034::681f:551a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://instagrambluetickteams.ga/instagram.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::681f:551a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/5.6.38 ASP.NET Resource Hash 1b9de2a23b6e8d13e5f0fa0b177a94e8da4a45cd0890160267667f2879430565 Request headers :method GET :authority instagrambluetickteams.ga :scheme https :path /instagram.php pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site same-origin sec-fetch-mode navigate sec-fetch-dest document referer https://instagrambluetickteams.ga/ accept-encoding gzip, deflate, br accept-language en-US cookie __cfduid=dfad09b2079603e927c793974134233681609570854; ARRAffinity=13e13d632ca61dd5d1edfc3055dc06d5598afe950aade10ec4b6f3021223e0a5 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://instagrambluetickteams.ga/ Response headers date Sat, 02 Jan 2021 07:00:59 GMT content-type text/html; charset=UTF-8 vary Accept-Encoding x-powered-by PHP/5.6.38 ASP.NET cf-cache-status DYNAMIC cf-request-id 07637f4e9a00003258c2835000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=wFeI7X6%2Fm4w%2FKYWJlPpuY1c2z0VuTTu%2FT33ZtILxc1sOnNr1U4IQeXFLKpD2hyrfbkSL4x7lkPEY3rcNl6Oo61Z3FQU%2BvYQIDUzh%2Feln0pKOhfFyUjp5rNIxOnZbEnBVxuttiijs"}],"group":"cf-nel","max_age":604800} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 60b29b2a98d33258-FRA content-encoding br
GET H2	200	index.css instagrambluetickteams.ga/css/	508 B 603 B	565ms 564ms	Stylesheet text/css	2606:4700:3034::681f:551a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://instagrambluetickteams.ga/css/index.css Requested by Host: instagrambluetickteams.ga URL: https://instagrambluetickteams.ga/instagram.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::681f:551a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash 797d2511706b2e3ebda99559b45b0bae9aaf6566e611d0b1cd48e9b8281965be Request headers Referer https://instagrambluetickteams.ga/instagram.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 02 Jan 2021 07:00:59 GMT content-encoding br cf-cache-status REVALIDATED nel {"report_to":"cf-nel","max_age":604800} x-powered-by ASP.NET cf-request-id 07637f50cb000032588d276000000001 last-modified Fri, 01 Jan 2021 18:14:58 GMT server cloudflare etag W/"5bf34b36ae0d61:0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=kMHFS79cdZ7geM5FS1IzYPg0PmuWHt%2FRJQReSUKK4MlL6O7TVE2NFyvzJZBKH4cUQnovZ%2B3pwGpKAF6wnNYWPa3AxqWLI%2Fm2f%2BiAdfuPdXs9FFIen9wIx%2BHYCLlu8wGRw6U%2BXImg"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-polished origSize=641 cf-ray 60b29b2e1cf93258-FRA cf-bgj minify
GET H2	200	instagram-to-gif-8.gif gifimage.net/wp-content/uploads/2017/11/	582 KB 583 KB	10ms 10ms	Image image/gif	2606:4700:3031::681b:a954 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://gifimage.net/wp-content/uploads/2017/11/instagram-to-gif-8.gif Requested by Host: instagrambluetickteams.ga URL: https://instagrambluetickteams.ga/instagram.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681b:a954 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cc614c59e963a9b9b2d20b319bed409b9016862b0097f939a60f2fc4323a1a72 Request headers Referer https://instagrambluetickteams.ga/instagram.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 02 Jan 2021 07:00:59 GMT cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 4 content-length 596133 cf-request-id 07637f50cc00004aaf59a0d000000001 last-modified Sun, 21 Jun 2020 02:14:56 GMT server cloudflare etag "918a5-5a88eb1468b34" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2FUh6nGHmI9XUceAroev83AOV1EMA7DXSPwtPwpNAbG9N1ITuSxH7lDug9rQXhTOuZbvPNvjvJKc0acY1rmwp1Xdt%2B3EvpD%2Frt1X0a4vuSD4M9RkoG%2FM7EDs%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif cache-control max-age=31536000 accept-ranges bytes cf-ray 60b29b2e1a0b4aaf-FRA
GET H2	200	tik.png instagrambluetickteams.ga/img/	179 KB 180 KB	965ms 964ms	Image image/png	2606:4700:3034::681f:551a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://instagrambluetickteams.ga/img/tik.png Requested by Host: instagrambluetickteams.ga URL: https://instagrambluetickteams.ga/instagram.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::681f:551a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash 38e0fc729a48ab90004406e7c728fa0bdb87b638c6301d4e5de05b22d275bf84 Request headers Referer https://instagrambluetickteams.ga/instagram.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 02 Jan 2021 07:01:00 GMT cf-cache-status MISS nel {"report_to":"cf-nel","max_age":604800} x-powered-by ASP.NET content-length 183354 cf-request-id 07637f50cc00003258e1358000000001 last-modified Fri, 01 Jan 2021 18:14:58 GMT server cloudflare etag "1922db36ae0d61:0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=FbEIXW6%2FszTCLZ0WDvWFUQ5oI%2FMsRQjygynmN%2B%2BGw3afygxkeC%2BUZn%2FOqcjXOzZNzGmGEtGuPf8xWSRiFjVgfrBhadd68CgKG6K9IfvMBlYmnacHUxDBSILRINWmR6Jizb18iXEF"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 60b29b2e1cfb3258-FRA

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Instagram (Social Network)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.instagrambluetickteams.ga/	1969-12-31 23:59:59	Name: ARRAffinity Value: 13e13d632ca61dd5d1edfc3055dc06d5598afe950aade10ec4b6f3021223e0a5
			.instagrambluetickteams.ga/	1970-01-19 15:49:22	Name: __cfduid Value: dfad09b2079603e927c793974134233681609570854

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

gifimage.net
instagrambluetickteams.ga
2606:4700:3031::681b:a954
2606:4700:3034::681f:551a
068d91bccfd2eac52a3f74190de0c9318212ef1ba775c095f0914e72cd94d81c
1b9de2a23b6e8d13e5f0fa0b177a94e8da4a45cd0890160267667f2879430565
38e0fc729a48ab90004406e7c728fa0bdb87b638c6301d4e5de05b22d275bf84
797d2511706b2e3ebda99559b45b0bae9aaf6566e611d0b1cd48e9b8281965be
cc614c59e963a9b9b2d20b319bed409b9016862b0097f939a60f2fc4323a1a72