instagramverifyaccount.com Open in urlscan Pro
166.62.27.185 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://instagramverifyaccount.com/
Submission Tags: phishingcatcher certstream Search All
Submission: On December 30 via api (December 30th 2019, 11:12:35 pm UTC) from CH

Summary HTTP 13 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 13 HTTP transactions. The main IP is 166.62.27.185, located in Scottsdale, United States and belongs to AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US. The main domain is instagramverifyaccount.com.

This is the only time instagramverifyaccount.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Instagram (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
5	166.62.27.185 166.62.27.185	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com)
1	2a00:1450:400... 2a00:1450:4001:825::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2606:4700:30:... 2606:4700:30::681c:7c5	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2a03:2880:f21... 2a03:2880:f21c:81e5:face:b00c:0:4420	32934 (FACEBOOK) (FACEBOOK - Facebook)
1 4	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK - Facebook)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK - Facebook)
13	6

5 166.62.27.185 (Scottsdale, United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-166-62-27-185.ip.secureserver.net

instagramverifyaccount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:825::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:30::681c:7c5 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

clipart.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f21c:81e5:face:b00c:0:4420 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

www.instagram.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland) 1 redirects

ASN32934 (FACEBOOK - Facebook, Inc., US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
staticxx.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	instagramverifyaccount.com instagramverifyaccount.com	30 KB
4	facebook.com 1 redirects staticxx.facebook.com www.facebook.com	1 KB
2	facebook.net connect.facebook.net	143 KB
1	instagram.com www.instagram.com	10 KB
1	clipart.info clipart.info	78 KB
1	googleapis.com ajax.googleapis.com	30 KB
13	6

	Domain	Requested by
5	instagramverifyaccount.com	instagramverifyaccount.com ajax.googleapis.com
2	www.facebook.com	instagramverifyaccount.com
2	staticxx.facebook.com	1 redirects instagramverifyaccount.com
2	connect.facebook.net	instagramverifyaccount.com connect.facebook.net
1	www.instagram.com	instagramverifyaccount.com
1	clipart.info	instagramverifyaccount.com
1	ajax.googleapis.com	instagramverifyaccount.com
13	7

This site contains links to these domains. Also see Links.

Domain
www.instagram.com
instagram.com
play.google.com

Subject Issuer	Validity	Valid
*.storage.googleapis.com GTS CA 1O1	`2019-12-03` - `2020-02-25`	3 months	crt.sh
sni133038.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-12-30` - `2020-07-07`	6 months	crt.sh
*.www.instagram.com DigiCert SHA2 High Assurance Server CA	`2019-12-08` - `2020-03-06`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2019-12-06` - `2020-03-05`	3 months	crt.sh

This page contains 2 frames:

Primary Page: http://instagramverifyaccount.com/
Frame ID: DD0C050620A9635B76D1F2E5E9597EE6
Requests: 12 HTTP requests in this frame

Frame: https://staticxx.facebook.com/connect/xd_arbiter.php?version=45
Frame ID: D17A762C1FDDE31FF09E3B77C1334555
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

13
Requests

62 %
HTTPS

83 %
IPv6

6
Domains

7
Subdomains

6
IPs

3
Countries

291 kB
Transfer

870 kB
Size

2
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://www.instagram.com/accounts/password/reset/
Title: Şifreni mi unuttun?

Search URL Search Domain Scan URL

URL: https://instagram.com/
Title: Kaydol

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=com.instagram.android&referrer=utm_source%3Dinstagramweb%26utm_campaign%3DloginPage%26utm_medium%3Dbadge

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=com.instagram.android&referrer=utm_source%3Dinstagramweb%26utm_campaign%3DloginPage%26utm_medium%3DinstallLink
Title: Instagram Google Play'de ücretsiz bul. Yükle

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5

http://connect.facebook.net/en_US/fbevents.js HTTP 307
https://connect.facebook.net/en_US/fbevents.js

Request Chain 6

https://staticxx.facebook.com/connect/xd_arbiter/r/lY4eZXm_YWu.js?version=42 HTTP 302
https://staticxx.facebook.com/connect/xd_arbiter.php?version=45

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
instagramverifyaccount.com/ 125 KB
29 KB 420ms
376ms Document
text/html 166.62.27.185
GoDaddy.com

General

Check archive.org

Show headers Download Go to

Full URL: http://instagramverifyaccount.com/
Protocol: HTTP/1.1
Server: 166.62.27.185 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS: ip-166-62-27-185.ip.secureserver.net
Software: Apache / PHP/5.6.40
Resource Hash: 73bb21ecd449fab3613cd75cd4cce1ee30698a5e2017ee395a1af0bcf43dfc02

Request headers

Host: instagramverifyaccount.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 30 Dec 2019 23:12:05 GMT
Server: Apache
X-Powered-By: PHP/5.6.40
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 29768
Keep-Alive: timeout=5
Content-Type: text/html; charset=UTF-8

GET
H/1.1 404
Not Found 9e6f34142751.js
instagramverifyaccount.com/static/bundles/FBSignupPage.js/ 0
0 375ms
356ms Script
text/html 166.62.27.185
GoDaddy.com

General

Check archive.org

Show headers Download Go to

Full URL: http://instagramverifyaccount.com/static/bundles/FBSignupPage.js/9e6f34142751.js
Requested by: Host: instagramverifyaccount.com
URL: http://instagramverifyaccount.com/
Protocol: HTTP/1.1
Server: 166.62.27.185 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS: ip-166-62-27-185.ip.secureserver.net
Software: Apache /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://instagramverifyaccount.com/
Origin: http://instagramverifyaccount.com

Response headers

Date: Mon, 30 Dec 2019 23:12:06 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found bb0e780484a5.js
instagramverifyaccount.com/static/bundles/LoginAndSignupPage.js/ 0
0 387ms
368ms Script
text/html 166.62.27.185
GoDaddy.com

General

Check archive.org

Show headers Download Go to

Full URL: http://instagramverifyaccount.com/static/bundles/LoginAndSignupPage.js/bb0e780484a5.js
Requested by: Host: instagramverifyaccount.com
URL: http://instagramverifyaccount.com/
Protocol: HTTP/1.1
Server: 166.62.27.185 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS: ip-166-62-27-185.ip.secureserver.net
Software: Apache /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://instagramverifyaccount.com/
Origin: http://instagramverifyaccount.com

Response headers

Date: Mon, 30 Dec 2019 23:12:06 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.1.1/ 85 KB
30 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:825::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.1.1/jquery.min.js

Requested by

Host: instagramverifyaccount.com
URL: http://instagramverifyaccount.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://instagramverifyaccount.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 19 Dec 2019 18:22:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 967764
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 30244
x-xss-protection: 0
last-modified: Tue, 20 Dec 2016 18:17:03 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 18 Dec 2020 18:22:41 GMT

GET
H2 200 1522452762Instagram-logo-png-text.png
clipart.info/images/ccovers/ 78 KB
78 KB 13885ms
13834ms Image
image/png 2606:4700:30::681c:7c5
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://clipart.info/images/ccovers/1522452762Instagram-logo-png-text.png
Requested by: Host: instagramverifyaccount.com
URL: http://instagramverifyaccount.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681c:7c5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 995483048bafe6083420ad1b2ea01ca13c7bdd1fe0c020cb9777fd6f8325fb1f

Request headers

Referer: http://instagramverifyaccount.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Dec 2019 23:12:19 GMT
cf-cache-status: MISS
last-modified: Fri, 30 Mar 2018 23:32:42 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 54d7b25649a89754-FRA
content-length: 79384

GET
H2 200 f06b908907d5.png
www.instagram.com/static/images/appstore-install-badges/badge_android_english-en.png/ 10 KB
10 KB 20ms
7ms Image
image/png 2a03:2880:f21c:81e5:face:b00c:0:4420
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.instagram.com/static/images/appstore-install-badges/badge_android_english-en.png/f06b908907d5.png
Requested by: Host: instagramverifyaccount.com
URL: http://instagramverifyaccount.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f21c:81e5:face:b00c:0:4420 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software: /
Resource Hash: 583714033cab0d76045a8d4bbfb2326983f40d5c2cfa239e9527da9617686e6b

Request headers

Referer: http://instagramverifyaccount.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Dec 2019 03:37:46 GMT
x-fb-trip-id: 1679558926
access-control-allow-origin: *
etag: "f06b908907d5"
vary: Accept-Encoding
content-type: image/png
status: 200
edge-control: max-age=1209600, no-transform
cache-control: public,max-age=31536000,immutable
content-encoding: br
content-length: 9799

GET
H2

200

fbevents.js Show response
connect.facebook.net/en_US/
Redirect Chain

http://connect.facebook.net/en_US/fbevents.js
https://connect.facebook.net/en_US/fbevents.js

126 KB
30 KB

17ms
6ms

Script
application/x-javascript

2a03:2880:f01c:8012:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: instagramverifyaccount.com
URL: http://instagramverifyaccount.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

1ada5b4d0b63b06d2bd668cd7d6597689796da41a434a675cfdbd2a1bddf251a

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: http://instagramverifyaccount.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-24=":443"; ma=3600
content-length: 30426
x-xss-protection: 0
pragma: public
x-fb-debug: nD4hSq533uJW8r2REnoFm1keDB/3MDot3wDjhmz3rSPV8MyBfm23XM1/51etAjWji/jN/zcvc4Nw3L450I3XWw==
x-fb-trip-id: 1850256238
date: Mon, 30 Dec 2019 23:12:06 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

Redirect headers

Location: https://connect.facebook.net/en_US/fbevents.js
Non-Authoritative-Reason: HSTS

GET
H2

200

xd_arbiter.php
staticxx.facebook.com/connect/ Frame D17A
Redirect Chain

https://staticxx.facebook.com/connect/xd_arbiter/r/lY4eZXm_YWu.js?version=42
https://staticxx.facebook.com/connect/xd_arbiter.php?version=45

0
0

6ms
5ms

Document
text/html

2a03:2880:f01c:8012:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://staticxx.facebook.com/connect/xd_arbiter.php?version=45

Requested by

Host: instagramverifyaccount.com
URL: http://instagramverifyaccount.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: staticxx.facebook.com
:scheme: https
:path: /connect/xd_arbiter.php?version=45
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: http://instagramverifyaccount.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://instagramverifyaccount.com/

Response headers

status: 200
content-type: text/html; charset=utf-8
expires: Tue, 29 Dec 2020 22:49:33 GMT
strict-transport-security: max-age=15552000; preload
content-encoding: br
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0
cache-control: public,max-age=31536000,immutable
x-fb-debug: iuhCde1N7j4s89LCdpLkbKiypRAxXwf5se5+lrHyZL4VC9In1M9+X4jJRu7GrnhTq/SIMOyN2CxD0fvR6FHX3w==
content-length: 12401
x-fb-trip-id: 1850256238
date: Mon, 30 Dec 2019 23:12:06 GMT
alt-svc: h3-24=":443"; ma=3600

Redirect headers

status: 302
location: https://staticxx.facebook.com/connect/xd_arbiter.php?version=45
x-xss-protection: 0
x-content-type-options: nosniff
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
strict-transport-security: max-age=15552000; preload
content-type: text/html; charset="utf-8"
x-fb-debug: RI3RV6ztJApBkHXeADSG736SlaZU2XK+HBIecb1g7L/2yDqidW1Q9zuBN3Ze4vG+YiiQio3V+YBbXZUm9wEk0Q==
content-length: 0
x-fb-trip-id: 1850256238
date: Mon, 30 Dec 2019 23:12:06 GMT
alt-svc: h3-24=":443"; ma=3600

POST
H/1.1 404
Not Found procesar.php Show response
instagramverifyaccount.com/ 315 B
507 B 188ms
188ms XHR
text/html 166.62.27.185
GoDaddy.com

General

Check archive.org

Show headers Download Go to

Full URL: http://instagramverifyaccount.com/procesar.php
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.1.1/jquery.min.js
Protocol: HTTP/1.1
Server: 166.62.27.185 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS: ip-166-62-27-185.ip.secureserver.net
Software: Apache /
Resource Hash: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Accept: */*
Referer: http://instagramverifyaccount.com/
Origin: http://instagramverifyaccount.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date: Mon, 30 Dec 2019 23:12:06 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

POST
H/1.1 404
Not Found procesar.php Show response
instagramverifyaccount.com/ 315 B
507 B 7573ms
7556ms XHR
text/html 166.62.27.185
GoDaddy.com

General

Check archive.org

Show headers Download Go to

Full URL: http://instagramverifyaccount.com/procesar.php
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.1.1/jquery.min.js
Protocol: HTTP/1.1
Server: 166.62.27.185 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS: ip-166-62-27-185.ip.secureserver.net
Software: Apache /
Resource Hash: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Accept: */*
Referer: http://instagramverifyaccount.com/
Origin: http://instagramverifyaccount.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date: Mon, 30 Dec 2019 23:12:13 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 1425767024389221 Show response
connect.facebook.net/signals/config/ 447 KB
113 KB 59ms
58ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1425767024389221?v=2.9.15&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

99318edc47a083c64a555b239fd1ca1b46ee1502e515822032d41d85a28d1861

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: http://instagramverifyaccount.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-24=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: G4NVBww3+SFMXYEQha92CGXiqZoh3FhuQuuJ/rQhR9tVxlXvDHdInVQ0kw5FUEHy1twE0Gx4Ncr/bdmPRpgXrw==
x-fb-trip-id: 1850256238
date: Mon, 30 Dec 2019 23:12:06 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
347 B 19ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1425767024389221&ev=PageView&dl=http%3A%2F%2Finstagramverifyaccount.com%2F&rl=&if=false&ts=1577747526240&sw=1600&sh=1200&v=2.9.15&r=stable&ec=0&o=30&fbp=fb.1.1577747526238.1523655443&it=1577747526114&coo=false&rqm=GET

Requested by

Host: instagramverifyaccount.com
URL: http://instagramverifyaccount.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: http://instagramverifyaccount.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Dec 2019 23:12:06 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-24=":443"; ma=3600
content-length: 44
expires: Mon, 30 Dec 2019 23:12:06 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
146 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1425767024389221&ev=Microdata&dl=http%3A%2F%2Finstagramverifyaccount.com%2F&rl=&if=false&ts=1577747527746&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Login%20%E2%80%A2%20Instagram%22%2C%22meta%3Adescription%22%3A%22Welcome%20back%20to%20Instagram.%20Sign%20in%20to%20check%20out%20what%20your%20friends%2C%20family%20%26%20interests%20have%20been%20capturing%20%26%20sharing%20around%20the%20world.%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.15&r=stable&ec=1&o=30&fbp=fb.1.1577747526238.1523655443&it=1577747526114&coo=false&es=automatic&tm=3&rqm=GET

Requested by

Host: instagramverifyaccount.com
URL: http://instagramverifyaccount.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: http://instagramverifyaccount.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Dec 2019 23:12:07 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-24=":443"; ma=3600
content-length: 44
expires: Mon, 30 Dec 2019 23:12:07 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Instagram (Social Network)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.facebook.com/	1970-01-19 08:25:23	Name: fr Value: 0iqcEA88eYg0fcyBX..BeCoRG...1.0.BeCoRG.
			.instagramverifyaccount.com/	1970-01-19 08:25:23	Name: _fbp Value: fb.1.1577747526238.1523655443

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
clipart.info
connect.facebook.net
instagramverifyaccount.com
staticxx.facebook.com
www.facebook.com
www.instagram.com
166.62.27.185
2606:4700:30::681c:7c5
2a00:1450:4001:825::200a
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a03:2880:f21c:81e5:face:b00c:0:4420
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1ada5b4d0b63b06d2bd668cd7d6597689796da41a434a675cfdbd2a1bddf251a
583714033cab0d76045a8d4bbfb2326983f40d5c2cfa239e9527da9617686e6b
73bb21ecd449fab3613cd75cd4cce1ee30698a5e2017ee395a1af0bcf43dfc02
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
99318edc47a083c64a555b239fd1ca1b46ee1502e515822032d41d85a28d1861
995483048bafe6083420ad1b2ea01ca13c7bdd1fe0c020cb9777fd6f8325fb1f
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

instagramverifyaccount.com Open in urlscan Pro 166.62.27.185 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

13 Requests

62 %HTTPS

83 %IPv6

6 Domains

7 Subdomains

6 IPs

3 Countries

291 kBTransfer

870 kBSize

2 Cookies

4 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

2 Cookies

Indicators

instagramverifyaccount.com Open in urlscan Pro
166.62.27.185 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

62 %
HTTPS

83 %
IPv6

6
Domains

7
Subdomains

6
IPs

3
Countries

291 kB
Transfer

870 kB
Size

2
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!