instagrambluetickteams.ga Open in urlscan Pro
2606:4700:3033::681f:541a  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://instagrambluetickteams.ga/ Page URL
2. https://instagrambluetickteams.ga/instagram.php Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response instagrambluetickteams.ga/	592 B 992 B	635ms 573ms	Document text/html	2606:4700:3033::681f:541a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://instagrambluetickteams.ga/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::681f:541a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/5.6.38 ASP.NET Resource Hash 068d91bccfd2eac52a3f74190de0c9318212ef1ba775c095f0914e72cd94d81c Request headers :method GET :authority instagrambluetickteams.ga :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 02 Jan 2021 03:01:30 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=d78675d7b6a4e1b334494730440c677c21609556489; expires=Mon, 01-Feb-21 03:01:29 GMT; path=/; domain=.instagrambluetickteams.ga; HttpOnly; SameSite=Lax; Secure ARRAffinity=13e13d632ca61dd5d1edfc3055dc06d5598afe950aade10ec4b6f3021223e0a5;Path=/;Domain=instagrambluetickteams.ga vary Accept-Encoding x-powered-by PHP/5.6.38 ASP.NET cf-cache-status DYNAMIC cf-request-id 0762a40d700000175e1f9b5000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=1AtjkIpafqWTTJgQ5pAFtKzuksAgWZgNoXSd5SkoHFWWU1igexuGj14dBhSxulpjqjuFppS5iahr2WZnMzrfUjCt2YE7346Apgx92LYdjcaFpSQz2bM8iCHRwYHTJYRLGUqpuh9N"}],"group":"cf-nel","max_age":604800} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 60b13c5bed24175e-FRA content-encoding br
GET H2	200	instagram-to-gif-8.gif gifimage.net/wp-content/uploads/2017/11/	582 KB 583 KB	104ms 81ms	Image image/gif	2606:4700:3031::681b:a954 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://gifimage.net/wp-content/uploads/2017/11/instagram-to-gif-8.gif Requested by Host: instagrambluetickteams.ga URL: https://instagrambluetickteams.ga/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681b:a954 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cc614c59e963a9b9b2d20b319bed409b9016862b0097f939a60f2fc4323a1a72 Request headers Referer https://instagrambluetickteams.ga/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 02 Jan 2021 03:01:30 GMT cf-cache-status MISS last-modified Sun, 21 Jun 2020 02:14:56 GMT server cloudflare etag "918a5-5a88eb1468b34" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=xpPZ1MW33U%2FToPNKOiR%2BJL3efZFo5XIbxdR4rzfSF%2BjOcSOKM0PBby4ApzYFKzGogzFmkHrFhiJHmRHocpdlw2pR5yjdHWbc5PzYxKyCfCy4dMv5F04odgY%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif cache-control max-age=31536000 nel {"report_to":"cf-nel","max_age":604800} accept-ranges bytes cf-ray 60b13c5fad4d2c3a-FRA content-length 596133 cf-request-id 0762a40fcb00002c3a99322000000001
GET H2	200	Primary Request instagram.php Show response instagrambluetickteams.ga/	976 B 708 B	158ms 158ms	Document text/html	2606:4700:3033::681f:541a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://instagrambluetickteams.ga/instagram.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::681f:541a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/5.6.38 ASP.NET Resource Hash 1b9de2a23b6e8d13e5f0fa0b177a94e8da4a45cd0890160267667f2879430565 Request headers :method GET :authority instagrambluetickteams.ga :scheme https :path /instagram.php pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site same-origin sec-fetch-mode navigate sec-fetch-dest document referer https://instagrambluetickteams.ga/ accept-encoding gzip, deflate, br accept-language en-US cookie __cfduid=d78675d7b6a4e1b334494730440c677c21609556489; ARRAffinity=13e13d632ca61dd5d1edfc3055dc06d5598afe950aade10ec4b6f3021223e0a5 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://instagrambluetickteams.ga/ Response headers date Sat, 02 Jan 2021 03:01:33 GMT content-type text/html; charset=UTF-8 vary Accept-Encoding x-powered-by PHP/5.6.38 ASP.NET cf-cache-status DYNAMIC cf-request-id 0762a41c090000175e62b64000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=pnw8A2oknQmgzFHd5k215c4zzUfPsla%2F7Wv4yB7CGzfGZg3c8b1quOnbf5aPdK2RHgTcrMi2xbWu%2Bl0FrI96zlRE%2FHEqxPiQpHwxW3P09rj3LshcPUrjpwXvruJjLw8G6yaIVYNI"}],"group":"cf-nel","max_age":604800} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 60b13c73490e175e-FRA content-encoding br
GET H2	200	index.css instagrambluetickteams.ga/css/	641 B 623 B	554ms 554ms	Stylesheet text/css	2606:4700:3033::681f:541a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://instagrambluetickteams.ga/css/index.css Requested by Host: instagrambluetickteams.ga URL: https://instagrambluetickteams.ga/instagram.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::681f:541a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash 1f3c31096b2c41ada314f83768fd9418c1650216d1145076ff3c86d008a52c37 Request headers Referer https://instagrambluetickteams.ga/instagram.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 02 Jan 2021 03:01:34 GMT content-encoding br cf-cache-status MISS last-modified Fri, 01 Jan 2021 18:14:58 GMT server cloudflare x-powered-by ASP.NET etag W/"5bf34b36ae0d61:0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=OLokXDYkFhAh8ccj%2Bp5OR1amnEobdDFWyDKEggRtEn6ci1PFYx75JNhKc3j7%2BiR4fnei9XT0OOgYogj9mxpkqz93Wm5Vt8VOzbCNiBCxBKjJdj4GmsPLhn1V7luhrjDXIU%2BrjKio"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 nel {"report_to":"cf-nel","max_age":604800} cf-ray 60b13c7449de175e-FRA cf-request-id 0762a41cae0000175efb36f000000001
GET H2	200	instagram-to-gif-8.gif gifimage.net/wp-content/uploads/2017/11/	582 KB 583 KB	11ms 10ms	Image image/gif	2606:4700:3031::681b:a954 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://gifimage.net/wp-content/uploads/2017/11/instagram-to-gif-8.gif Requested by Host: instagrambluetickteams.ga URL: https://instagrambluetickteams.ga/instagram.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681b:a954 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cc614c59e963a9b9b2d20b319bed409b9016862b0097f939a60f2fc4323a1a72 Request headers Referer https://instagrambluetickteams.ga/instagram.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 02 Jan 2021 03:01:33 GMT cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 3 content-length 596133 cf-request-id 0762a41caf00002c3a68119000000001 last-modified Sun, 21 Jun 2020 02:14:56 GMT server cloudflare etag "918a5-5a88eb1468b34" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=T9uAEUl%2BPFwFDxEx2qQ0DFq6qMcU3oo7420BWPV1gpd1uptr30V1L7wS9lOHpH5kT1d%2B8agSCf%2Fvb8lwtpSvqeGB%2BRK5n2fXG7Tt4dgrtrmgiz5CQ4bbuPU%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif cache-control max-age=31536000 accept-ranges bytes cf-ray 60b13c7449bb2c3a-FRA
GET H2	200	tik.png instagrambluetickteams.ga/img/	179 KB 180 KB	946ms 945ms	Image image/png	2606:4700:3033::681f:541a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://instagrambluetickteams.ga/img/tik.png Requested by Host: instagrambluetickteams.ga URL: https://instagrambluetickteams.ga/instagram.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::681f:541a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash 38e0fc729a48ab90004406e7c728fa0bdb87b638c6301d4e5de05b22d275bf84 Request headers Referer https://instagrambluetickteams.ga/instagram.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 02 Jan 2021 03:01:34 GMT cf-cache-status MISS nel {"report_to":"cf-nel","max_age":604800} x-powered-by ASP.NET content-length 183354 cf-request-id 0762a41caf0000175e0f239000000001 last-modified Fri, 01 Jan 2021 18:14:58 GMT server cloudflare etag "1922db36ae0d61:0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=pfc6LoY3Icr0a53uH7a9Z86UqBkD5uRLDfg7kdKXSWkksQT1mYgqbP2p%2FyCYynyfXOjg1Th7OgGD%2B4hY%2BTZLnN88wFgqFEaAAugyvJyfHTuPKvgJDt2C%2Bl9JtRswDOtsM17DrWJ2"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 60b13c7449e0175e-FRA

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Instagram (Social Network)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.instagrambluetickteams.ga/	1969-12-31 23:59:59	Name: ARRAffinity Value: 13e13d632ca61dd5d1edfc3055dc06d5598afe950aade10ec4b6f3021223e0a5
			.instagrambluetickteams.ga/	1970-01-19 15:49:08	Name: __cfduid Value: d78675d7b6a4e1b334494730440c677c21609556489

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

gifimage.net
instagrambluetickteams.ga
2606:4700:3031::681b:a954
2606:4700:3033::681f:541a
068d91bccfd2eac52a3f74190de0c9318212ef1ba775c095f0914e72cd94d81c
1b9de2a23b6e8d13e5f0fa0b177a94e8da4a45cd0890160267667f2879430565
1f3c31096b2c41ada314f83768fd9418c1650216d1145076ff3c86d008a52c37
38e0fc729a48ab90004406e7c728fa0bdb87b638c6301d4e5de05b22d275bf84
cc614c59e963a9b9b2d20b319bed409b9016862b0097f939a60f2fc4323a1a72