instagramssupport.gq Open in urlscan Pro
2606:4700:3031::ac43:96b1  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response instagramssupport.gq/	4 KB 2 KB	381ms 364ms	Document text/html	2606:4700:3031::ac43:96b1 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://instagramssupport.gq/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::ac43:96b1 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash 7eff5b595e92db343200090f15257a0e1009705002872048ad876193ba1abfaf Request headers :method GET :authority instagramssupport.gq :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 14 Feb 2021 18:31:59 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=d2a407e90a1a81f4351ac1181b5470d171613327519; expires=Tue, 16-Mar-21 18:31:59 GMT; path=/; domain=.instagramssupport.gq; HttpOnly; SameSite=Lax vary Accept-Encoding x-powered-by ASP.NET cf-cache-status DYNAMIC cf-request-id 084369662600002c3ef4a6a000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=3UD93ZFGvuQ31KFBcWFyYJ5%2BXDz2E5DCHh%2F1eDfViz874LLiixiTnqgnJ9%2FTjeM9mBims0%2FpvFeqyyy1XAnLn%2Br0y2thSUevC1dy1J5YZDnhYUB%2FpYdNktpq92gyRcey0w%3D%3D"}],"group":"cf-nel","max_age":604800} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 6218de836dc42c3e-FRA content-encoding br
GET H2	200	font-awesome.min.css maxcdn.bootstrapcdn.com/font-awesome/4.4.0/css/	26 KB 6 KB	30ms 11ms	Stylesheet text/css	2001:4de0:ac19::1:b:1b HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/font-awesome/4.4.0/css/font-awesome.min.css Requested by Host: instagramssupport.gq URL: https://instagramssupport.gq/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac19::1:b:1b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software / Resource Hash 936ffccdc35bc55221e669d0e76034af76ba8c080c1b1149144dbbd3b5311829 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://instagramssupport.gq/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 14 Feb 2021 18:31:59 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 12 Dec 2018 18:35:19 GMT etag "1544639719" vary Accept-Encoding x-cache HIT content-type text/css; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * content-length 6079
GET		font-awesome.min.css cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/	0 0
GET H2	200	facebook-1.jpg pocketnow.com/files/2020/04/	59 KB 60 KB	43ms 18ms	Image image/jpeg	2606:4700:10::6814:2326 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://pocketnow.com/files/2020/04/facebook-1.jpg Requested by Host: instagramssupport.gq URL: https://instagramssupport.gq/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6814:2326 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9754db8d738069857ca5b5b3b2a4a559c5b988df9e10f619a5a667f69840c6f8 Security Headers Name Value X-Content-Type-Options nosniff, nosniff X-Xss-Protection 1; mode=block Request headers Referer https://instagramssupport.gq/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 14 Feb 2021 18:31:59 GMT x-content-type-options nosniff, nosniff cf-cache-status HIT age 2081 cf-polished origSize=66046, status=webp_bigger content-length 60358 x-xss-protection 1; mode=block x-ua-compatible IE=Edge,chrome=1 referrer-policy no-referrer-when-downgrade last-modified Wed, 22 Apr 2020 21:09:04 GMT server cloudflare etag "5ea0b270-101fe" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/jpeg cf-request-id 08436967a50000bf28d08dd000000001 accept-ranges bytes cf-ray 6218de85d845bf28-FRA cf-bgj imgq:100,h2pri
GET H2	200	fb.gif instagramssupport.gq/	642 KB 643 KB	325ms 325ms	Image image/gif	2606:4700:3031::ac43:96b1 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://instagramssupport.gq/fb.gif Requested by Host: instagramssupport.gq URL: https://instagramssupport.gq/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::ac43:96b1 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash c5879e67a21effd737a9e85338d90d1a000110c8d8da1c1f4d322803e84a28f7 Request headers Referer https://instagramssupport.gq/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 14 Feb 2021 18:31:59 GMT cf-cache-status DYNAMIC last-modified Sat, 13 Feb 2021 09:36:02 GMT server cloudflare x-powered-by ASP.NET etag "3f4a18a5eb1d71:0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" nel {"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=M1pyk5mKJQS7ugwuk5HyYtTvUARuYapv1mU95lRIPmokhP4j0y85b4X15DJxLWYAMVcABkmDO8aZXY9pXPJjNEOnF%2F9afFKexsJPpgiZMnl0PvcaZXvYRRs%2B%2BHmTsGvB7g%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif cache-control max-age=31536000 accept-ranges bytes cf-ray 6218de85ac132c3e-FRA content-length 657116 cf-request-id 084369678d00002c3ef4a93000000001

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

cdnjs.cloudflare.com

URL

httpks://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Instagram (Social Network)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.instagramssupport.gq/	1970-01-19 16:51:59	Name: __cfduid Value: d2a407e90a1a81f4351ac1181b5470d171613327519

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
instagramssupport.gq
maxcdn.bootstrapcdn.com
pocketnow.com
cdnjs.cloudflare.com
2001:4de0:ac19::1:b:1b
2606:4700:10::6814:2326
2606:4700:3031::ac43:96b1
7eff5b595e92db343200090f15257a0e1009705002872048ad876193ba1abfaf
936ffccdc35bc55221e669d0e76034af76ba8c080c1b1149144dbbd3b5311829
9754db8d738069857ca5b5b3b2a4a559c5b988df9e10f619a5a667f69840c6f8
c5879e67a21effd737a9e85338d90d1a000110c8d8da1c1f4d322803e84a28f7