lghelpcenters.com - urlscan.io

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 6 HTTP transactions. The main IP is 194.169.211.15, located in Germany and belongs to MARBIS, DE. The main domain is lghelpcenters.com.

This is the only time lghelpcenters.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Instagram (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
2	194.169.211.15 194.169.211.15	199610 (MARBIS) (MARBIS)
1	2606:4700:303... 2606:4700:3034::ac43:c38e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a03:2880:f21... 2a03:2880:f21c:81e5:face:b00c:0:4420	32934 (FACEBOOK) (FACEBOOK)
6	3

2 194.169.211.15 (Germany)

ASN199610 (MARBIS, DE)
PTR: vweb13.nitrado.net

lghelpcenters.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3034::ac43:c38e (United States)

ASN13335 (CLOUDFLARENET, US)

resimag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f21c:81e5:face:b00c:0:4420 (Ireland)

ASN32934 (FACEBOOK, US)

www.instagram.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	instagram.com www.instagram.com	34 KB
2	lghelpcenters.com lghelpcenters.com	643 KB
1	resimag.com resimag.com	17 KB
6	3

	Domain	Requested by
3	www.instagram.com	lghelpcenters.com
2	lghelpcenters.com	lghelpcenters.com
1	resimag.com	lghelpcenters.com
6	3

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-07-07` - `2021-07-07`	a year	crt.sh
*.www.instagram.com DigiCert SHA2 High Assurance Server CA	`2020-08-18` - `2020-11-16`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://lghelpcenters.com/username.php
Frame ID: C4F8BFF616070C1E0023F0B4ED1FE3F2
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

6
Requests

67 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

694 kB
Transfer

855 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2

http://www.instagram.com/static/bundles/es6/ConsumerUICommons.css/4c68346f3fc7.css HTTP 307
https://www.instagram.com/static/bundles/es6/ConsumerUICommons.css/4c68346f3fc7.css

Request Chain 3

http://www.instagram.com/static/bundles/es6/ConsumerAsyncCommons.css/f5339c1f472f.css HTTP 307
https://www.instagram.com/static/bundles/es6/ConsumerAsyncCommons.css/f5339c1f472f.css

Request Chain 4

http://www.instagram.com/static/bundles/es6/Challenge.css/e6dcc76c8eaf.css HTTP 307
https://www.instagram.com/static/bundles/es6/Challenge.css/e6dcc76c8eaf.css

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request username.php Show response lghelpcenters.com/	3 KB 1 KB	45ms 31ms	Document text/html	194.169.211.15 MARBIS
General Check archive.org Show headers Download Go to Full URL http://lghelpcenters.com/username.php Protocol HTTP/1.1 Server 194.169.211.15 , Germany, ASN199610 (MARBIS, DE), Reverse DNS vweb13.nitrado.net Software Apache/2.2.22 / Resource Hash `b50fbf5eb75ba79d34881acabc75fe4a5bbe9d9366113831594ecb13fe3ac639` Request headers Host lghelpcenters.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sun, 06 Sep 2020 01:45:32 GMT Server Apache/2.2.22 Vary Accept-Encoding Content-Encoding gzip Content-Length 1227 Connection close Content-Type text/html; charset=UTF-8
GET H2	200	b4f2d9307c7.png resimag.com/p1/	16 KB 17 KB	49ms 29ms	Image image/png	2606:4700:3034::ac43:c38e CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://resimag.com/p1/b4f2d9307c7.png Requested by Host: lghelpcenters.com URL: http://lghelpcenters.com/username.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::ac43:c38e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PleskLin Resource Hash `91b3a5574ee57d310ef3d175804f95528487d5110d657743f13e427019c726e5` Request headers Referer http://lghelpcenters.com/username.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Sun, 06 Sep 2020 01:45:32 GMT cf-cache-status BYPASS server cloudflare x-powered-by PleskLin expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png status 200 cache-control max-age=0, no-cache, no-store, must-revalidate accept-ranges bytes cf-ray 5ce482dd0d16bf00-FRA content-length 16541 cf-request-id 0502b01e260000bf007ca81200000001 expires Mon, 10 Apr 1972 00:00:00 GMT
GET H/1.1	200 OK	fb.gif lghelpcenters.com/	642 KB 642 KB	45ms 31ms	Image image/gif	194.169.211.15 MARBIS
General Check archive.org Show headers Download Go to Show image Full URL http://lghelpcenters.com/fb.gif Requested by Host: lghelpcenters.com URL: http://lghelpcenters.com/username.php Protocol HTTP/1.1 Server 194.169.211.15 , Germany, ASN199610 (MARBIS, DE), Reverse DNS vweb13.nitrado.net Software Apache/2.2.22 / Resource Hash `c5879e67a21effd737a9e85338d90d1a000110c8d8da1c1f4d322803e84a28f7` Request headers Referer http://lghelpcenters.com/username.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sun, 06 Sep 2020 01:45:33 GMT Last-Modified Sat, 05 Sep 2020 13:22:09 GMT Server Apache/2.2.22 ETag "344e36-a06dc-5ae90df5ee669" Content-Type image/gif Connection close Accept-Ranges bytes Content-Length 657116
GET H2	200	4c68346f3fc7.css www.instagram.com/static/bundles/es6/ConsumerUICommons.css/ Redirect Chain http://www.instagram.com/static/bundles/es6/ConsumerUICommons.css/4c68346f3fc7.css https://www.instagram.com/static/bundles/es6/ConsumerUICommons.css/4c68346f3fc7.css	113 KB 14 KB	29ms 12ms	Stylesheet text/css	2a03:2880:f21c:81e5:face:b00c:0:4420 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.instagram.com/static/bundles/es6/ConsumerUICommons.css/4c68346f3fc7.css Requested by Host: lghelpcenters.com URL: http://lghelpcenters.com/username.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f21c:81e5:face:b00c:0:4420 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash `8ba4b1252264531dd9c3470451173cd553e4832ed959857dd6c3f2b319be4899` Request headers Referer http://lghelpcenters.com/username.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 31 Aug 2020 05:45:11 GMT x-fb-trip-id 1679558926 status 200 etag "4c68346f3fc7" vary Accept-Encoding content-type text/css access-control-allow-origin * edge-control max-age=1209600, no-transform cache-control public,max-age=31536000,immutable content-encoding br content-length 13855 Redirect headers Location https://www.instagram.com/static/bundles/es6/ConsumerUICommons.css/4c68346f3fc7.css Non-Authoritative-Reason HSTS Access-Control-Allow-Credentials true Access-Control-Allow-Origin http://lghelpcenters.com
GET H2	200	f5339c1f472f.css www.instagram.com/static/bundles/es6/ConsumerAsyncCommons.css/ Redirect Chain http://www.instagram.com/static/bundles/es6/ConsumerAsyncCommons.css/f5339c1f472f.css https://www.instagram.com/static/bundles/es6/ConsumerAsyncCommons.css/f5339c1f472f.css	16 KB 3 KB	23ms 6ms	Stylesheet text/css	2a03:2880:f21c:81e5:face:b00c:0:4420 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.instagram.com/static/bundles/es6/ConsumerAsyncCommons.css/f5339c1f472f.css Requested by Host: lghelpcenters.com URL: http://lghelpcenters.com/username.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f21c:81e5:face:b00c:0:4420 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash `c6f34c73fb517a1dcb1e10298b863bc04e21485a3fb88b19310494670b6bed6a` Request headers Referer http://lghelpcenters.com/username.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 31 Aug 2020 05:45:11 GMT x-fb-trip-id 1679558926 status 200 etag "f5339c1f472f" vary Accept-Encoding content-type text/css access-control-allow-origin * edge-control max-age=1209600, no-transform cache-control public,max-age=31536000,immutable content-encoding br content-length 3081 Redirect headers Location https://www.instagram.com/static/bundles/es6/ConsumerAsyncCommons.css/f5339c1f472f.css Non-Authoritative-Reason HSTS Access-Control-Allow-Credentials true Access-Control-Allow-Origin http://lghelpcenters.com
GET H2	200	e6dcc76c8eaf.css www.instagram.com/static/bundles/es6/Challenge.css/ Redirect Chain http://www.instagram.com/static/bundles/es6/Challenge.css/e6dcc76c8eaf.css https://www.instagram.com/static/bundles/es6/Challenge.css/e6dcc76c8eaf.css	65 KB 17 KB	23ms 7ms	Stylesheet text/css	2a03:2880:f21c:81e5:face:b00c:0:4420 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.instagram.com/static/bundles/es6/Challenge.css/e6dcc76c8eaf.css Requested by Host: lghelpcenters.com URL: http://lghelpcenters.com/username.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f21c:81e5:face:b00c:0:4420 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash `16c16a825280d02191f5bfa3b9084965ccfe31ca16621354c2625fd0e7e15dd3` Request headers Referer http://lghelpcenters.com/username.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 31 Aug 2020 05:45:11 GMT x-fb-trip-id 1679558926 status 200 etag "e6dcc76c8eaf" vary Accept-Encoding content-type text/css access-control-allow-origin * edge-control max-age=1209600, no-transform cache-control public,max-age=31536000,immutable content-encoding br content-length 17467 Redirect headers Location https://www.instagram.com/static/bundles/es6/Challenge.css/e6dcc76c8eaf.css Non-Authoritative-Reason HSTS Access-Control-Allow-Credentials true Access-Control-Allow-Origin http://lghelpcenters.com

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Instagram (Social Network)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

lghelpcenters.com
resimag.com
www.instagram.com
194.169.211.15
2606:4700:3034::ac43:c38e
2a03:2880:f21c:81e5:face:b00c:0:4420
16c16a825280d02191f5bfa3b9084965ccfe31ca16621354c2625fd0e7e15dd3
8ba4b1252264531dd9c3470451173cd553e4832ed959857dd6c3f2b319be4899
91b3a5574ee57d310ef3d175804f95528487d5110d657743f13e427019c726e5
b50fbf5eb75ba79d34881acabc75fe4a5bbe9d9366113831594ecb13fe3ac639
c5879e67a21effd737a9e85338d90d1a000110c8d8da1c1f4d322803e84a28f7
c6f34c73fb517a1dcb1e10298b863bc04e21485a3fb88b19310494670b6bed6a

lghelpcenters.com Open in urlscan Pro 194.169.211.15 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

6 Requests

67 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

694 kBTransfer

855 kBSize

0 Cookies

0 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

lghelpcenters.com Open in urlscan Pro
194.169.211.15 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

67 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

694 kB
Transfer

855 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!