copyright.lnstagram.com.removed.cf
Open in
urlscan Pro
129.121.2.210
Malicious Activity!
Public Scan
Submitted URL: https://copyright.lnstagram.com.removed.cf/
Effective URL: https://copyright.lnstagram.com.removed.cf/username.php
Submission Tags: @phishunt_io
Submission: On February 10 via api from ES
Effective URL: https://copyright.lnstagram.com.removed.cf/username.php
Submission Tags: @phishunt_io
Submission: On February 10 via api from ES
Summary
This website contacted 4 IPs
in 1 countries
across 4 domains to perform 12 HTTP transactions.
The main IP is 129.121.2.210, located in
United States and
belongs to ASMALLORANGE1, US.
The main domain is copyright.lnstagram.com.removed.cf.
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on February 10th 2021. Valid for: 3 months.
This is the only time copyright.lnstagram.com.removed.cf was scanned on urlscan.io!
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on February 10th 2021. Valid for: 3 months.
This is the only time copyright.lnstagram.com.removed.cf was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Instagram (Social Network)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 5 | 129.121.2.210 129.121.2.210 | 62729 (ASMALLORA...) (ASMALLORANGE1) | |
| 2 | 168.119.145.176 168.119.145.176 | 24940 (HETZNER-AS) (HETZNER-AS) | |
| 4 | 2406:da00:ff0... 2406:da00:ff00::22c7:8eeb | 14618 (AMAZON-AES) (AMAZON-AES) | |
| 12 | 4 |
5
129.121.2.210
(United States)
ASN62729 (ASMALLORANGE1, US)
PTR: ip-129-121-2-210.local
ASN62729 (ASMALLORANGE1, US)
PTR: ip-129-121-2-210.local
| copyright.lnstagram.com.removed.cf |
2
168.119.145.176
(United States)
ASN24940 (HETZNER-AS, DE)
PTR: static.176.145.119.168.clients.your-server.de
ASN24940 (HETZNER-AS, DE)
PTR: static.176.145.119.168.clients.your-server.de
| i.imgyukle.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 5 |
removed.cf
copyright.lnstagram.com.removed.cf |
17 KB |
| 4 |
instagram.com
instagram.com |
48 KB |
| 2 |
imgyukle.com
i.imgyukle.com |
7 KB |
| 0 |
sitekodlari.com
Failed
ir.sitekodlari.com Failed |
|
| 12 | 4 |
| Domain | Requested by | |
|---|---|---|
| 5 | copyright.lnstagram.com.removed.cf |
copyright.lnstagram.com.removed.cf
|
| 4 | instagram.com |
copyright.lnstagram.com.removed.cf
|
| 2 | i.imgyukle.com |
copyright.lnstagram.com.removed.cf
|
| 0 | ir.sitekodlari.com Failed |
copyright.lnstagram.com.removed.cf
|
| 12 | 4 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| itunes.apple.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| copyright.lnstagram.com.removed.cf ZeroSSL RSA Domain Secure Site CA |
2021-02-10 - 2021-05-11 |
3 months | crt.sh |
| imgyukle.com R3 |
2020-12-05 - 2021-03-05 |
3 months | crt.sh |
| *.instagram.com DigiCert SHA2 High Assurance Server CA |
2021-01-31 - 2021-04-30 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://copyright.lnstagram.com.removed.cf/username.php
Frame ID: 6B04836183693F15236389266C865C9D
Requests: 12 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://copyright.lnstagram.com.removed.cf/ Page URL
- https://copyright.lnstagram.com.removed.cf/username.php Page URL
Detected technologies
Nginx
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
URL: https://itunes.apple.com/app/instagram/id389801252?pt=428156&ct=igweb.loginPage.installLink&mt=8&vt=lo
Title: InstagramGet Instagram from Google Play Or App StoreGet
Title: InstagramGet Instagram from Google Play Or App StoreGet
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://copyright.lnstagram.com.removed.cf/ Page URL
- https://copyright.lnstagram.com.removed.cf/username.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
/
copyright.lnstagram.com.removed.cf/ |
3 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
dm.png
copyright.lnstagram.com.removed.cf/img/ |
327 B 327 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
SHNOWo.png
i.imgyukle.com/2020/07/17/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
SHN2fR.png
i.imgyukle.com/2020/07/17/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
sagtusengelleme1.js
ir.sitekodlari.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
username.php
copyright.lnstagram.com.removed.cf/ |
7 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
57e12b49691b.css
instagram.com/static/bundles/es6/ProfilePageContainer.css/ |
104 KB 27 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
4c68346f3fc7.css
instagram.com/static/bundles/es6/ConsumerUICommons.css/ |
113 KB 14 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
f5339c1f472f.css
instagram.com/static/bundles/es6/ConsumerAsyncCommons.css/ |
16 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
894f617d9b9a.css
instagram.com/static/bundles/es6/Consumer.css/ |
28 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ig.png
copyright.lnstagram.com.removed.cf/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
face.png
copyright.lnstagram.com.removed.cf/ |
8 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- ir.sitekodlari.com
- URL
- http://ir.sitekodlari.com/sagtusengelleme1.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Instagram (Social Network)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
copyright.lnstagram.com.removed.cf
i.imgyukle.com
instagram.com
ir.sitekodlari.com
ir.sitekodlari.com
129.121.2.210
168.119.145.176
2406:da00:ff00::22c7:8eeb
0297481a91b0d693e15dc883226406fc4ea2c41520eeb124107bf07253fa6154
1c9b3883f84fc719bed5e4d9688f2c03a679ad91dfe322001f50eb4e47cfbe01
21fce00b08a1e238d6c44ea652cbdc7dc824cd6a39af1eeca33453ce356482b9
4f538084c1efe33a27cc41e1306a667d2a3fcbe0c9aec36852e25fb6a79cf0ea
735f7ebf6e827db314649423976c7d3d2f8c19e286e95106a19cf6ff69389ff1
8ba4b1252264531dd9c3470451173cd553e4832ed959857dd6c3f2b319be4899
8f148045a8859c0ac235dd19d88d0d66020e88cc5e79846cb05b8d8e3382168c
9ebf7183c271399e53f28b3ad69793f3a2ba1b6622b8d58a27d62bb8e5dd9a5d
c6f34c73fb517a1dcb1e10298b863bc04e21485a3fb88b19310494670b6bed6a
d7540d7c8a6c455fea0faf3aee4f5e5eb775735625e4aca7b26a93f5c1fe77dd
e0bd957ccfef739d618b4e1a8ac1c2b19f90037065cee1641427e705ef1debad