form-instagram-help-center.ml Open in urlscan Pro
2606:4700:3030::ac43:aedc  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response form-instagram-help-center.ml/	3 KB 2 KB	165ms 139ms	Document text/html	2606:4700:3030::ac43:aedc CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://form-instagram-help-center.ml/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::ac43:aedc , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6eb9aab82c0a386b147d21161c8eec94811bb58b7be53e05c5dbd55a36f45b14 Request headers :method GET :authority form-instagram-help-center.ml :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 19 Nov 2020 16:12:36 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=d848d31af780d4e4cd46a2a9356c72f891605802356; expires=Sat, 19-Dec-20 16:12:36 GMT; path=/; domain=.form-instagram-help-center.ml; HttpOnly; SameSite=Lax; Secure vary Accept-Encoding x-turbo-charged-by LiteSpeed cf-cache-status DYNAMIC cf-request-id 0682e08620000006258902e000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=G6WW186xmU9WYJ56kYaWYdxF%2Bbvfrg0rJ2gly%2BUDF5qRECP2XDMsaG61MhnohUQ8TgDyBuaf%2FCd%2BSGd1TbkllC1JABnfDiCoATledYPA2g8nNOeYk5ekek9hPGN0yYLX7Stezk%2F90vqvdg%3D%3D"}],"group":"cf-nel","max_age":604800} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 5f4b36b69ffd0625-FRA content-encoding br
GET H2	200	yFzPFU.png i.imgyukle.com/2020/06/06/	22 KB 22 KB	88ms 25ms	Image image/png	116.202.246.29 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgyukle.com/2020/06/06/yFzPFU.png Requested by Host: form-instagram-help-center.ml URL: https://form-instagram-help-center.ml/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 116.202.246.29 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.29.246.202.116.clients.your-server.de Software nginx / Resource Hash c3ef88b7b2aff92b1ccf6dffa47f25f0cae9cc9dc8d3234b36bc9418b4c15332 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=15768000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://form-instagram-help-center.ml/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 19 Nov 2020 16:12:36 GMT referrer-policy origin last-modified Fri, 05 Jun 2020 21:48:38 GMT server nginx etag "5edabdb6-5600" x-frame-options SAMEORIGIN content-type image/png x-xss-protection 1; mode=block x-permitted-cross-domain-policies master-only feature-policy geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none; content-security-policy frame-ancestors 'self'; strict-transport-security max-age=15768000; includeSubDomains accept-ranges bytes content-length 22016 x-content-type-options nosniff
GET H2	200	371907300_INSTAGRAM_ICON_400px.gif cliply.co/wp-content/uploads/2019/07/	20 KB 21 KB	66ms 23ms	Image image/gif	104.27.130.68 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cliply.co/wp-content/uploads/2019/07/371907300_INSTAGRAM_ICON_400px.gif Requested by Host: form-instagram-help-center.ml URL: https://form-instagram-help-center.ml/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.27.130.68 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash af31c049443d813a9d2dee582b9b54558ca26336acf31008e966176d966bf5b2 Request headers Referer https://form-instagram-help-center.ml/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 19 Nov 2020 16:12:36 GMT cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 1331369 content-length 20568 cf-request-id 0682e086e10000c85b91af4000000001 last-modified Thu, 25 Jul 2019 12:56:38 GMT server cloudflare etag "5058-5d39a706-275a6dd10209c4f8;;;" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=5xDaM%2FF1jswWR2gwDAET8vmICJnaZUSRuOa9%2FdjdMfIDiNNW2x5IcFqHGjmURecZVr7k71YA3ZBGgCtCTf64pbbysIxm9NF8cOk%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif cache-control public, max-age=2592000 x-turbo-charged-by LiteSpeed accept-ranges bytes cf-ray 5f4b36b7cf17c85b-AMS expires Fri, 04 Dec 2020 06:23:07 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Instagram (Social Network)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.form-instagram-help-center.ml/	1970-01-19 14:46:34	Name: __cfduid Value: d848d31af780d4e4cd46a2a9356c72f891605802356

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cliply.co
form-instagram-help-center.ml
i.imgyukle.com
104.27.130.68
116.202.246.29
2606:4700:3030::ac43:aedc
6eb9aab82c0a386b147d21161c8eec94811bb58b7be53e05c5dbd55a36f45b14
af31c049443d813a9d2dee582b9b54558ca26336acf31008e966176d966bf5b2
c3ef88b7b2aff92b1ccf6dffa47f25f0cae9cc9dc8d3234b36bc9418b4c15332