www.instagram.com.sg1.putrivpn1.us.kg Open in urlscan Pro
2606:4700:3032::6815:2c1d  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.instagram.com.sg1.putrivpn1.us.kg/	11 KB 5 KB	1463ms 618ms	Document text/html	2606:4700:3032::6815:2c1d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.instagram.com.sg1.putrivpn1.us.kg/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::6815:2c1d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 936f349f7e36f68b00ec9207192d9c1a75e4a24f10f4fbaafdcdc8bfc467aec1 Security Headers Name Value Content-Security-Policy frame-ancestors https://web.telegram.org Strict-Transport-Security max-age=35768000 X-Frame-Options ALLOW-FROM https://web.telegram.org Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers cache-control no-store cf-cache-status DYNAMIC cf-ray 8cbba76b1fc4cba2-LAX content-encoding br content-security-policy frame-ancestors https://web.telegram.org content-type text/html; charset=utf-8 date Tue, 01 Oct 2024 10:08:53 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A61Nh7etqde6%2Bpt8kTPgMKdZ6nYLLyFYA%2F2s8eXHWPmMikIhKY4uo1D%2FaAIZ6OfcUxDoB6zZ4wP6PY53crTrDC8MStnUbHiELQUyahmzkjtFPHVgTwQoDazXfwBJq1w96jsN8BtCbrMouOK2NDlgDIrmJEg%2FAB48Qo1iOFCHjRh%2Fr6e%2F"}],"group":"cf-nel","max_age":604800} server cloudflare speculation-rules "/cdn-cgi/speculation" strict-transport-security max-age=35768000 vary Accept-Encoding x-frame-options ALLOW-FROM https://web.telegram.org
GET H2	200	speculation www.instagram.com.sg1.putrivpn1.us.kg/cdn-cgi/	128 B 506 B	63ms 62ms	Other application/speculationrules+json	2606:4700:3032::6815:2c1d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.instagram.com.sg1.putrivpn1.us.kg/cdn-cgi/speculation Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::6815:2c1d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://www.instagram.com.sg1.putrivpn1.us.kg Referer https://www.instagram.com.sg1.putrivpn1.us.kg/ Response headers nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yLAwVHV3hcdKocuW7RjLpc9WWHSaVwzcNDpeSVK0%2BTWfxOG39ZtGfF0vcgVYRjyS6smMkqsCMMrsWds1UfyoidnKf4sfpIau1cIQSmpH0t2okkELvH%2BiLZEHyHLLFVEG8bM3%2BhOWAdPAbruCQkUJwB4Yl4bLWCk3yfcqzKPb7MZn5tIt"}],"group":"cf-nel","max_age":604800} cf-ray 8cbba76f0890cba2-LAX access-control-allow-origin https://www.instagram.com.sg1.putrivpn1.us.kg content-length 128 date Tue, 01 Oct 2024 10:08:53 GMT content-type application/speculationrules+json vary Origin, Accept-Encoding server cloudflare
GET H2	200	font-roboto.css telegram.org/css/	6 KB 894 B	748ms 235ms	Stylesheet text/css	2001:67c:4e8:f004::9 TELEGRAM
General Check archive.org Show headers Download Go to Full URL https://telegram.org/css/font-roboto.css?1 Requested by Host: www.instagram.com.sg1.putrivpn1.us.kg URL: https://www.instagram.com.sg1.putrivpn1.us.kg/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (TELEGRAM, VG), Reverse DNS Software nginx/1.18.0 / Resource Hash 84b97b3fa8847b64c6d3833561e4b3146530577171e85ad226578a087db70974 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.instagram.com.sg1.putrivpn1.us.kg/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=345600 content-encoding gzip etag W/"63512b7d-1816" expires Sat, 05 Oct 2024 10:08:54 GMT date Tue, 01 Oct 2024 10:08:54 GMT content-type text/css last-modified Thu, 20 Oct 2022 11:05:33 GMT server nginx/1.18.0
GET H2	200	bootstrap.min.css telegram.org/css/	42 KB 10 KB	947ms 435ms	Stylesheet text/css	2001:67c:4e8:f004::9 TELEGRAM
General Check archive.org Show headers Download Go to Full URL https://telegram.org/css/bootstrap.min.css?3 Requested by Host: www.instagram.com.sg1.putrivpn1.us.kg URL: https://www.instagram.com.sg1.putrivpn1.us.kg/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (TELEGRAM, VG), Reverse DNS Software nginx/1.18.0 / Resource Hash f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.instagram.com.sg1.putrivpn1.us.kg/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=345600 content-encoding gzip etag W/"5a05e7c6-a61b" expires Sat, 05 Oct 2024 10:08:54 GMT date Tue, 01 Oct 2024 10:08:54 GMT content-type text/css last-modified Fri, 10 Nov 2017 17:54:14 GMT server nginx/1.18.0
GET H2	200	telegram.css telegram.org/css/	113 KB 29 KB	949ms 437ms	Stylesheet text/css	2001:67c:4e8:f004::9 TELEGRAM
General Check archive.org Show headers Download Go to Full URL https://telegram.org/css/telegram.css?241 Requested by Host: www.instagram.com.sg1.putrivpn1.us.kg URL: https://www.instagram.com.sg1.putrivpn1.us.kg/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (TELEGRAM, VG), Reverse DNS Software nginx/1.18.0 / Resource Hash f5f739b99351c1d64b3b890e80e78a9267e9ad2efe8116999ead3749d849e131 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.instagram.com.sg1.putrivpn1.us.kg/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=345600 content-encoding gzip etag W/"66f1ab9b-1c21c" expires Sat, 05 Oct 2024 10:08:54 GMT date Tue, 01 Oct 2024 10:08:54 GMT content-type text/css last-modified Mon, 23 Sep 2024 17:55:39 GMT server nginx/1.18.0
GET H2	200	C24YEwxTATLFFDFFTTTldzBXHb79HYNWFtVZoMjxooDDTLTwzQ9VB17Ea0F7EbmQ3AbPK9L1eqZKK_7G9YNKXt2TMq8j2mEqQDq3s26xHHkDM017kXSAjTD2k_Sigh7gDHPejKxukhXQePyW6DHl-kdNf0npwa_4rjVLlcpSYMOk2D9KLokIH42-Ns9pqTBR03n76... cdn5.cdn-telegram.org/file/	39 KB 39 KB	226ms 60ms	Image image/jpeg	34.111.108.175 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://cdn5.cdn-telegram.org/file/C24YEwxTATLFFDFFTTTldzBXHb79HYNWFtVZoMjxooDDTLTwzQ9VB17Ea0F7EbmQ3AbPK9L1eqZKK_7G9YNKXt2TMq8j2mEqQDq3s26xHHkDM017kXSAjTD2k_Sigh7gDHPejKxukhXQePyW6DHl-kdNf0npwa_4rjVLlcpSYMOk2D9KLokIH42-Ns9pqTBR03n769hVr4BHTQdUfV1Rt1fhKhHgExwpGgt8LTAeEse1N8gENBcC81a-npNyk57EtCK6KsG1d35Q7YGUCHe2FdRTHqoyFQ_uBIt_lYPlcgvis3QxyIf_TpFTdbNJHKm32wQkKJ6YGAtHLUs3I6r7ew.jpg Requested by Host: www.instagram.com.sg1.putrivpn1.us.kg URL: https://www.instagram.com.sg1.putrivpn1.us.kg/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.111.108.175 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 175.108.111.34.bc.googleusercontent.com Software nginx/1.18.0 / Resource Hash 751e2e338c627f10fa8526042d52820abee1773bcb9f770c7be7a071ebdcbdfd Security Headers Name Value Content-Security-Policy default-src 'none'; sandbox Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.instagram.com.sg1.putrivpn1.us.kg/ Response headers access-control-expose-headers Accept-Ranges, Content-Range, Content-Length etag "e3a8f8d89cb35f45903dee2d31219bc3ee36bbad" age 6334 x-content-type-options nosniff alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 01 Oct 2024 08:23:19 GMT content-type image/jpeg x-frame-options DENY strict-transport-security max-age=31536000; includeSubDomains; preload content-security-policy default-src 'none'; sandbox cache-control max-age=3600,public via 1.1 google accept-ranges bytes, bytes access-control-allow-origin * content-length 39691 x-xss-protection 1; mode=block server nginx/1.18.0
GET H2	200	tgwallpaper.min.js Show response telegram.org/js/	3 KB 2 KB	1146ms 635ms	Script application/javascript	2001:67c:4e8:f004::9 TELEGRAM
General Check archive.org Show headers Download Go to Full URL https://telegram.org/js/tgwallpaper.min.js?3 Requested by Host: www.instagram.com.sg1.putrivpn1.us.kg URL: https://www.instagram.com.sg1.putrivpn1.us.kg/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (TELEGRAM, VG), Reverse DNS Software nginx/1.18.0 / Resource Hash 2031e418ee10af8110729b3f327b968462fc0a9d8d1da095387bb472ccd0dee6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.instagram.com.sg1.putrivpn1.us.kg/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=345600 content-encoding gzip etag W/"62211da5-ba3" expires Sat, 05 Oct 2024 10:08:54 GMT date Tue, 01 Oct 2024 10:08:54 GMT content-type application/javascript last-modified Thu, 03 Mar 2022 19:57:25 GMT server nginx/1.18.0
GET H2	200	pattern.svg telegram.org/img/tgme/	226 KB 81 KB	207ms 206ms	Image image/svg+xml	2001:67c:4e8:f004::9 TELEGRAM
General Check archive.org Show headers Download Go to Show image Full URL https://telegram.org/img/tgme/pattern.svg?1 Requested by Host: telegram.org URL: https://telegram.org/css/telegram.css?241 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (TELEGRAM, VG), Reverse DNS Software nginx/1.18.0 / Resource Hash 118add53487c02aaf5b5ab9f69380fa06717deb10492e14aaa487e3c62806ad4 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://telegram.org/css/telegram.css?241 Response headers cache-control max-age=345600 content-encoding gzip etag W/"63b70e44-3891a" expires Sat, 05 Oct 2024 10:08:54 GMT access-control-allow-origin * date Tue, 01 Oct 2024 10:08:54 GMT content-type image/svg+xml last-modified Thu, 05 Jan 2023 17:52:04 GMT server nginx/1.18.0
GET H2	200	KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2 telegram.org/fonts/Roboto/	11 KB 11 KB	606ms 203ms	Font application/octet-stream	2001:67c:4e8:f004::9 TELEGRAM
General Check archive.org Show headers Download Go to Full URL https://telegram.org/fonts/Roboto/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2 Requested by Host: telegram.org URL: https://telegram.org/css/font-roboto.css?1 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (TELEGRAM, VG), Reverse DNS Software nginx/1.18.0 / Resource Hash 0f53e8b0a717ca4ce313eec62b90d41db62c2f4946259a65c93bf8e84c5b0c44 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://www.instagram.com.sg1.putrivpn1.us.kg Referer https://telegram.org/css/font-roboto.css?1 Response headers cache-control max-age=345600 etag "63512b7d-2b20" expires Sat, 05 Oct 2024 10:08:55 GMT accept-ranges bytes access-control-allow-origin * content-length 11040 date Tue, 01 Oct 2024 10:08:55 GMT content-type application/octet-stream last-modified Thu, 20 Oct 2022 11:05:33 GMT server nginx/1.18.0
GET H2	200	KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 telegram.org/fonts/Roboto/	11 KB 11 KB	805ms 403ms	Font application/octet-stream	2001:67c:4e8:f004::9 TELEGRAM
General Check archive.org Show headers Download Go to Full URL https://telegram.org/fonts/Roboto/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 Requested by Host: telegram.org URL: https://telegram.org/css/font-roboto.css?1 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (TELEGRAM, VG), Reverse DNS Software nginx/1.18.0 / Resource Hash 796de064b8d80eba7ccacb8ba67d77fdbcdf4b385c844645d452c24537b3108f Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://www.instagram.com.sg1.putrivpn1.us.kg Referer https://telegram.org/css/font-roboto.css?1 Response headers cache-control max-age=345600 etag "63512b7d-2b14" expires Sat, 05 Oct 2024 10:08:55 GMT accept-ranges bytes access-control-allow-origin * content-length 11028 date Tue, 01 Oct 2024 10:08:55 GMT content-type application/octet-stream last-modified Thu, 20 Oct 2022 11:05:33 GMT server nginx/1.18.0
GET		tg://resolve?domain=Tingkeh tg://resolve?domain=Tingkeh	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

resolve

URL

tg://resolve?domain=Tingkeh

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telegram (Instant Messenger)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| TWallpaper string| protoUrl object| tme_bg function| toggleTheme object| darkMedia

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.instagram.com.sg1.putrivpn1.us.kg/	1970-01-20 23:57:43	Name: stel_ssid Value: 6c87f2de76ea63fdc3_14280869980316990531

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	error	URL: https://www.instagram.com.sg1.putrivpn1.us.kg/ Message: Not allowed to launch 'tg://resolve?domain=Tingkeh' because a user gesture is required.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors https://web.telegram.org
Strict-Transport-Security	max-age=35768000
X-Frame-Options	ALLOW-FROM https://web.telegram.org

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn5.cdn-telegram.org
resolve
telegram.org
www.instagram.com.sg1.putrivpn1.us.kg
resolve
2001:67c:4e8:f004::9
2606:4700:3032::6815:2c1d
34.111.108.175
0f53e8b0a717ca4ce313eec62b90d41db62c2f4946259a65c93bf8e84c5b0c44
118add53487c02aaf5b5ab9f69380fa06717deb10492e14aaa487e3c62806ad4
11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d
2031e418ee10af8110729b3f327b968462fc0a9d8d1da095387bb472ccd0dee6
751e2e338c627f10fa8526042d52820abee1773bcb9f770c7be7a071ebdcbdfd
796de064b8d80eba7ccacb8ba67d77fdbcdf4b385c844645d452c24537b3108f
84b97b3fa8847b64c6d3833561e4b3146530577171e85ad226578a087db70974
936f349f7e36f68b00ec9207192d9c1a75e4a24f10f4fbaafdcdc8bfc467aec1
f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3
f5f739b99351c1d64b3b890e80e78a9267e9ad2efe8116999ead3749d849e131