www.instagram-violation-report-form.gq Open in urlscan Pro
2606:4700:3036::681c:1e5c  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.instagram-violation-report-form.gq/	3 KB 2 KB	703ms 680ms	Document text/html	2606:4700:3036::681c:1e5c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.instagram-violation-report-form.gq/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3036::681c:1e5c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.4.13 ASP.NET Resource Hash 34f01eb607d870e0cd0dc95dcfd311e1ef8a67774ba0b7605f124254e86aac04 Request headers :method GET :authority www.instagram-violation-report-form.gq :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 26 Dec 2020 12:32:51 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=dffa9e6e4cb691357d053503b1d447faf1608985970; expires=Mon, 25-Jan-21 12:32:50 GMT; path=/; domain=.instagram-violation-report-form.gq; HttpOnly; SameSite=Lax vary Accept-Encoding x-powered-by PHP/7.4.13 ASP.NET cf-cache-status DYNAMIC cf-request-id 0740a2a03600000609cb03f000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=RTsN6hEiSHIXed78lmuxIbeC%2FwH6fUlppcrFWA3u5w0oR%2F26ivRFeOwz2LHXxw4BcAdphQbkeYCiK4uf3GYFWr9nqB73l2Q%2BJfEY%2BtP3Jy%2FsjV6TjkbtjNhIoD6mlUS4c1967TwtkxY8ndopSDU%2BbG0QoA%3D%3D"}],"group":"cf-nel","max_age":604800} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 607ad3ad280f0609-FRA content-encoding br
GET H2	200	images encrypted-tbn0.gstatic.com/	6 KB 6 KB	35ms 13ms	Image image/png	2a00:1450:4001:809::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://encrypted-tbn0.gstatic.com/images?q=tbn%3AANd9GcTjtjBw4xwF01ZdKL1cmnYZD3vdavlQPOWA7w&usqp=CAU Requested by Host: www.instagram-violation-report-form.gq URL: https://www.instagram-violation-report-form.gq/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 98f05227be484074f46ceadea84463b984100426e231d5267862ed0b8afd7f64 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.instagram-violation-report-form.gq/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 26 Dec 2020 12:32:51 GMT x-content-type-options nosniff last-modified Tue, 30 Jul 2019 11:17:00 GMT server sffe content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6187 x-xss-protection 0 expires Sun, 26 Dec 2021 12:32:51 GMT
GET H2	200	1-instagram.gif cdn.dribbble.com/users/2475489/screenshots/9553468/	523 KB 524 KB	117ms 32ms	Image image/gif	192.229.220.206 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.dribbble.com/users/2475489/screenshots/9553468/1-instagram.gif Requested by Host: www.instagram-violation-report-form.gq URL: https://www.instagram-violation-report-form.gq/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.229.220.206 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (ska/F731) / Resource Hash 11b4c1b5bd083683bfa2f61ce15fd849d3dbf4fbabd365b6f75bdbb7d8b51e61 Request headers Referer https://www.instagram-violation-report-form.gq/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 26 Dec 2020 12:32:51 GMT via 1.1 e7311287a3a52035e5fcaf9a58791105.cloudfront.net (CloudFront) last-modified Fri, 17 Jan 2020 12:43:59 GMT server ECAcc (ska/F731) age 12419273 etag "962980cb229082d7981bfd510885421b" x-cache HIT content-type image/gif cache-control max-age=315576000 x-amz-version-id AZ2BVyO84zEYC7OEr35FnDSF3cwep1o7 x-amz-cf-pop IAD79-C1 accept-ranges bytes content-length 536008 x-amz-cf-id pEMRWAhLL24FbhZZdBBa2D58CKSQbIvqwj2jLC2lqhpzIsEjTp2SrQ== expires Mon, 10 Jun 2030 06:29:01 GMT
GET H2	200	fbgif.gif www.instagram-violation-report-form.gq/	418 KB 418 KB	1003ms 1002ms	Image image/gif	2606:4700:3036::681c:1e5c CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.instagram-violation-report-form.gq/fbgif.gif Requested by Host: www.instagram-violation-report-form.gq URL: https://www.instagram-violation-report-form.gq/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3036::681c:1e5c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash 6364f8ae43e00b02c1cfcb4c62f4d8bd7b2871b36056877908798dbd6f89b279 Request headers Referer https://www.instagram-violation-report-form.gq/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 26 Dec 2020 12:32:52 GMT cf-cache-status MISS nel {"report_to":"cf-nel","max_age":604800} x-powered-by ASP.NET content-length 427550 cf-request-id 0740a2a2ef0000060934205000000001 last-modified Sat, 26 Dec 2020 08:53:08 GMT server cloudflare etag "445298864dbd61:0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=upIaMYNbLDKNgBQb7C%2BAw2hsxOWwlQxUn2Afp4vBgM6gp5TjTGJGaUw1ftha7%2FOljX1RyZtrfbe%2Bkyhq4WerXIVXBJCjTDmh4li4MqxATOkxnR7jet%2Bo0YAKZyNJYC4twzHFF4%2Ba7LVDsVj7x0uEweUWpA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif cache-control max-age=31536000 accept-ranges bytes cf-ray 607ad3b17aca0609-FRA

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Instagram (Social Network)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.instagram-violation-report-form.gq/	1970-01-19 15:39:37	Name: __cfduid Value: dffa9e6e4cb691357d053503b1d447faf1608985970

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://www.instagram-violation-report-form.gq/(Line 107) Message: Script Created by Borislav Qenzy

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.dribbble.com
encrypted-tbn0.gstatic.com
www.instagram-violation-report-form.gq
192.229.220.206
2606:4700:3036::681c:1e5c
2a00:1450:4001:809::200e
11b4c1b5bd083683bfa2f61ce15fd849d3dbf4fbabd365b6f75bdbb7d8b51e61
34f01eb607d870e0cd0dc95dcfd311e1ef8a67774ba0b7605f124254e86aac04
6364f8ae43e00b02c1cfcb4c62f4d8bd7b2871b36056877908798dbd6f89b279
98f05227be484074f46ceadea84463b984100426e231d5267862ed0b8afd7f64