instahelpsformteam.tk Open in urlscan Pro
2a02:4780:dead:3650::1  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response instahelpsformteam.tk/	3 KB 2 KB	358ms 110ms	Document text/html	2a02:4780:dead:3650::1 AWEX
General Check archive.org Show headers Download Go to Full URL https://instahelpsformteam.tk/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:4780:dead:3650::1 , United States, ASN204915 (AWEX, CY), Reverse DNS Software awex / Resource Hash 8289448c7a7717609f84ab6665314564b4a4e08ec000aacfde52762199a520aa Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers :method GET :authority instahelpsformteam.tk :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 27 Mar 2021 19:39:18 GMT content-type text/html; charset=UTF-8 server awex x-xss-protection 1; mode=block x-content-type-options nosniff x-request-id 70adf27062b2c090e6bedbdc6d79a898 content-encoding gzip
GET H2	200	main.css instahelpsformteam.tk/	3 KB 1 KB	110ms 109ms	Stylesheet text/css	2a02:4780:dead:3650::1 AWEX
General Check archive.org Show headers Download Go to Full URL https://instahelpsformteam.tk/main.css Requested by Host: instahelpsformteam.tk URL: https://instahelpsformteam.tk/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:4780:dead:3650::1 , United States, ASN204915 (AWEX, CY), Reverse DNS Software awex / Resource Hash 30ec974e4f604f22d60412ab21ab4cddc03643ba44b68a1adf48832ef4e0475d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://instahelpsformteam.tk/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 27 Mar 2021 19:39:18 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 25 Mar 2021 15:03:57 GMT server awex content-type text/css x-xss-protection 1; mode=block x-request-id 1d9b566fdb61d86ba3aa419f483a5fa9
GET H2	200	free.min.css kit-free.fontawesome.com/releases/latest/css/	59 KB 14 KB	29ms 11ms	Stylesheet text/css	151.139.128.8 HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://kit-free.fontawesome.com/releases/latest/css/free.min.css Requested by Host: instahelpsformteam.tk URL: https://instahelpsformteam.tk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.139.128.8 , United States, ASN20446 (HIGHWINDS3, US), Reverse DNS Software / Resource Hash 4f02bd6f018d6f08c37c39f2d114101beac342c2c065046635e5ed0c42853590 Request headers Referer https://instahelpsformteam.tk/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 27 Mar 2021 19:39:18 GMT content-encoding gzip last-modified Mon, 05 Oct 2020 16:00:45 GMT etag "1601913645" vary Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding x-hw 1616873958.cds164.fr8.hn,1616873958.cds228.fr8.c content-type text/css access-control-allow-origin * access-control-max-age 3000 cache-control max-age=60, private, must-revalidate access-control-allow-methods GET accept-ranges bytes content-length 13753
GET H2	200	NYTY8h.md.png i.imgyukle.com/2021/03/09/	104 KB 104 KB	43ms 19ms	Image image/png	168.119.145.176 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgyukle.com/2021/03/09/NYTY8h.md.png Requested by Host: instahelpsformteam.tk URL: https://instahelpsformteam.tk/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 168.119.145.176 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.176.145.119.168.clients.your-server.de Software nginx / PleskLin Resource Hash 39521008c3b5b9ce4bb6c033cfa51fb78f53fd322ea67279901fceb069351748 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://instahelpsformteam.tk/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 27 Mar 2021 19:39:18 GMT referrer-policy origin last-modified Tue, 09 Mar 2021 15:22:31 GMT server nginx x-powered-by PleskLin etag "604792b7-19f96" x-frame-options SAMEORIGIN content-type image/png x-xss-protection 1; mode=block x-permitted-cross-domain-policies master-only feature-policy geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none; content-security-policy frame-ancestors 'self'; accept-ranges bytes content-length 106390 x-content-type-options nosniff

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Instagram (Social Network)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

i.imgyukle.com
instahelpsformteam.tk
kit-free.fontawesome.com
151.139.128.8
168.119.145.176
2a02:4780:dead:3650::1
30ec974e4f604f22d60412ab21ab4cddc03643ba44b68a1adf48832ef4e0475d
39521008c3b5b9ce4bb6c033cfa51fb78f53fd322ea67279901fceb069351748
4f02bd6f018d6f08c37c39f2d114101beac342c2c065046635e5ed0c42853590
8289448c7a7717609f84ab6665314564b4a4e08ec000aacfde52762199a520aa