www.filesusr.com Open in urlscan Pro
2600:9000:2490:c000:0:7dcd:9780:93a1 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.tinyurl.com/4nh3stx7/
Effective URL:
https://www.filesusr.com/html/ca29a3_bf6671138bd57af9b3b1ede7eb701f0e.html?987217*bWF0YXRyb2xlczUwMDBAZ21haWwuY29t*https:...
Submission: On May 17 via api (May 17th 2024, 9:15:32 pm UTC) from US — Scanned from DE

Summary HTTP 14 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 6 IPs in 2 countries across 7 domains to perform 14 HTTP transactions. The main IP is 2600:9000:2490:c000:0:7dcd:9780:93a1, located in United States and belongs to AMAZON-02, US. The main domain is www.filesusr.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on December 25th 2023. Valid for: 6 months.

This is the only time www.filesusr.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Instagram (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
2 2	172.67.1.225 172.67.1.225	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:9000:249... 2600:9000:2490:c000:0:7dcd:9780:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:813::2009	15169 (GOOGLE) (GOOGLE)
8	2a03:2880:f27... 2a03:2880:f276:1e9:face:b00c:0:4420	32934 (FACEBOOK) (FACEBOOK)
1	2a00:1450:400... 2a00:1450:4001:830::200a	15169 (GOOGLE) (GOOGLE)
1	172.67.191.13 172.67.191.13	13335 (CLOUDFLAR...) (CLOUDFLARENET)
14	6

2 172.67.1.225 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

www.tinyurl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tinyurl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2490:c000:0:7dcd:9780:93a1 (United States)

ASN16509 (AMAZON-02, US)

www.filesusr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2009 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.blogger.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a03:2880:f276:1e9:face:b00c:0:4420 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.instagram.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.191.13 (United States)

ASN13335 (CLOUDFLARENET, US)

exploits-fr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	instagram.com www.instagram.com — Cisco Umbrella Rank: 1895	816 KB
2	blogger.com www.blogger.com — Cisco Umbrella Rank: 11861	15 KB
2	tinyurl.com 2 redirects www.tinyurl.com — Cisco Umbrella Rank: 263447 tinyurl.com — Cisco Umbrella Rank: 17151	1 KB
1	exploits-fr.com exploits-fr.com	4 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 380	34 KB
1	filesusr.com www.filesusr.com	4 MB
0	unpkg.com Failed unpkg.com Failed
14	7

	Domain	Requested by
8	www.instagram.com	www.filesusr.com
2	www.blogger.com	www.filesusr.com
1	exploits-fr.com
1	ajax.googleapis.com	www.filesusr.com
1	www.filesusr.com
1	tinyurl.com	1 redirects
1	www.tinyurl.com	1 redirects
0	unpkg.com Failed	www.filesusr.com
14	8

This site contains links to these domains. Also see Links.

Domain
about.facebook.com
about.instagram.com
help.instagram.com
developers.facebook.com

Subject Issuer	Validity	Valid
*.filesusr.com Sectigo RSA Domain Validation Secure Server CA	`2023-12-25` - `2024-06-22`	6 months	crt.sh
*.blogger.com WR2	`2024-05-06` - `2024-07-29`	3 months	crt.sh
*.www.instagram.com DigiCert SHA2 High Assurance Server CA	`2024-02-25` - `2024-05-25`	3 months	crt.sh
upload.video.google.com WR2	`2024-05-06` - `2024-07-29`	3 months	crt.sh
exploits-fr.com Cloudflare Inc ECC CA-3	`2024-02-08` - `2024-12-31`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.filesusr.com/html/ca29a3_bf6671138bd57af9b3b1ede7eb701f0e.html?987217*bWF0YXRyb2xlczUwMDBAZ21haWwuY29t*https://www.surveymonkey.com/r/SYRY2RS**Instagram
Frame ID: 930E180635C8966EB3ACFE37E9973FDD
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Instagram

Page URL History Show full URLs

http://www.tinyurl.com/4nh3stx7/ HTTP 307
https://www.tinyurl.com/4nh3stx7/ HTTP 301
http://tinyurl.com/4nh3stx7/ HTTP 307
https://tinyurl.com/4nh3stx7/ HTTP 301
https://www.filesusr.com/html/ca29a3_bf6671138bd57af9b3b1ede7eb701f0e.html?987217*bWF0YXRyb2xlczUwMDB... Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

93 %
HTTPS

67 %
IPv6

7
Domains

8
Subdomains

6
IPs

2
Countries

5376 kB
Transfer

5482 kB
Size

1
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://about.facebook.com/meta
Title: Meta

Search URL Search Domain Scan URL

URL: https://about.instagram.com/
Title: Información

Search URL Search Domain Scan URL

URL: https://about.instagram.com/blog/
Title: Blog

Search URL Search Domain Scan URL

URL: https://help.instagram.com/
Title: Ayuda

Search URL Search Domain Scan URL

URL: https://developers.facebook.com/docs/instagram
Title: API

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.tinyurl.com/4nh3stx7/ HTTP 307
https://www.tinyurl.com/4nh3stx7/ HTTP 301
http://tinyurl.com/4nh3stx7/ HTTP 307
https://tinyurl.com/4nh3stx7/ HTTP 301
https://www.filesusr.com/html/ca29a3_bf6671138bd57af9b3b1ede7eb701f0e.html?987217*bWF0YXRyb2xlczUwMDBAZ21haWwuY29t*https://www.surveymonkey.com/r/SYRY2RS**Instagram Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request ca29a3_bf6671138bd57af9b3b1ede7eb701f0e.html Show response
www.filesusr.com/html/
Redirect Chain

http://www.tinyurl.com/4nh3stx7/
https://www.tinyurl.com/4nh3stx7/
http://tinyurl.com/4nh3stx7/
https://tinyurl.com/4nh3stx7/
https://www.filesusr.com/html/ca29a3_bf6671138bd57af9b3b1ede7eb701f0e.html?987217*bWF0YXRyb2xlczUwMDBAZ21haWwuY29t*https://www.surveymonkey.com/r/SYRY2RS**Instagram

4 MB
4 MB

63ms
8ms

Document
text/html

2600:9000:2490:c000:0:7dcd:9780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.filesusr.com/html/ca29a3_bf6671138bd57af9b3b1ede7eb701f0e.html?987217*bWF0YXRyb2xlczUwMDBAZ21haWwuY29t*https://www.surveymonkey.com/r/SYRY2RS**Instagram
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2490:c000:0:7dcd:9780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.21.4.1 /
Resource Hash: 9ff801298d1af2640890052e2ff88045f3f9740c268bc969c5bc02bbac5ec862

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 11724
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=15552000, immutable
content-length: 4608867
content-type: text/html; charset=utf-8
date: Fri, 17 May 2024 18:00:02 GMT
etag: "bf6671138bd57af9b3b1ede7eb701f0e"
expires: Fri, 17 May 2024 19:00:02 GMT
last-modified: Wed, 08 May 2024 09:52:26 GMT
server: openresty/1.21.4.1
timing-allow-origin: *
via: 1.1 google, 1.1 e1f996a9009532eeea33edfd32ef3240.cloudfront.net (CloudFront)
x-amz-cf-id: _xxUGEQm0a1bbKZfVSrDXRlGU8i1G-4_2gbvD2EVyhLDj47Yxk8T9Q==
x-amz-cf-pop: FRA56-P6
x-cache: Hit from cloudfront
x-seen-by: gcp.us-central-1.media-router-6fb99f9c5-vfws2

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: max-age=0, must-revalidate, no-cache, no-store, private
cf-cache-status: HIT
cf-ray: 88569f70ae8e9c12-FRA
content-type: text/html; charset=UTF-8
date: Fri, 17 May 2024 21:15:26 GMT
location: https://www.filesusr.com/html/ca29a3_bf6671138bd57af9b3b1ede7eb701f0e.html?987217*bWF0YXRyb2xlczUwMDBAZ21haWwuY29t*https://www.surveymonkey.com/r/SYRY2RS**Instagram
referrer-policy: unsafe-url
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-robots-tag: noindex
x-tinyurl-redirect: eyJpdiI6IkcyS3RXTmxuOVRubzkxOUxYVkJhZEE9PSIsInZhbHVlIjoiWXIxeVNMNkNXUjNmQ253bHF3NkQxQ3pQRW50V3VTYmV3Z0w5d3RMK1Y5RzlKcWlSQzJRcHh4YjVTd2RSL3k2QkNZbWVybFBwUFE4QklMWExURDljVGc9PSIsIm1hYyI6IjU5MWMwNTdiZGRmYTcwM2ZiZWM2MmVmYWI1YmFmMDllM2VmZmQyYTJiODM2Yzc1N2Q1YjMyM2FmOGJjYjQ1OWUiLCJ0YWciOiIifQ==
x-tinyurl-redirect-type: redirect
x-xss-protection: 1; mode=block

GET
H2 200 55013136-widget_css_bundle.css
www.blogger.com/static/v1/widgets/ 30 KB
7 KB 33ms
7ms Stylesheet
text/css 2a00:1450:4001:813::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/static/v1/widgets/55013136-widget_css_bundle.css

Requested by

Host: www.filesusr.com
URL: https://www.filesusr.com/html/ca29a3_bf6671138bd57af9b3b1ede7eb701f0e.html?987217*bWF0YXRyb2xlczUwMDBAZ21haWwuY29t*https://www.surveymonkey.com/r/SYRY2RS**Instagram

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1a2eca9e492e3a21e02dd77ad44d7af45c4091d35ede79e948b7a3f23e5b3617

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.filesusr.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 14:31:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 283432
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6620
x-xss-protection: 0
last-modified: Tue, 14 May 2024 07:53:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
expires: Wed, 14 May 2025 14:31:34 GMT

GET
H2 200 1938605287-css_bundle_v2.css
www.blogger.com/static/v1/widgets/ 36 KB
8 KB 34ms
8ms Stylesheet
text/css 2a00:1450:4001:813::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/static/v1/widgets/1938605287-css_bundle_v2.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

765601709b703cd426bea3c604efc4a3efcf22e886eb8b78f4521b5d5f8d0482

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.filesusr.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 04:33:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 60124
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7999
x-xss-protection: 0
last-modified: Wed, 27 Mar 2019 18:23:10 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
expires: Sat, 17 May 2025 04:33:22 GMT

GET vue@next
unpkg.com/ 0
0

GET
H2 200 fdfe239b7c9f.png
www.instagram.com/static/images/homepage/screenshots/screenshot1.png/ 182 KB
182 KB 40ms
13ms Image
image/png 2a03:2880:f276:1e9:face:b00c:0:4420
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.instagram.com/static/images/homepage/screenshots/screenshot1.png/fdfe239b7c9f.png
Requested by: Host: www.filesusr.com
URL: https://www.filesusr.com/html/ca29a3_bf6671138bd57af9b3b1ede7eb701f0e.html?987217*bWF0YXRyb2xlczUwMDBAZ21haWwuY29t*https://www.surveymonkey.com/r/SYRY2RS**Instagram
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f276:1e9:face:b00c:0:4420 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 9a70a7b2974cd3af3bfb572fe5a4b01bb93e25fe3dd0a4cd6a411912508050c3

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.filesusr.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 16 May 2024 19:07:51 GMT
content-encoding: br
x-fb-load: 391
etag: "fdfe239b7c9f"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
edge-control: max-age=1209600, no-transform
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
content-length: 186179

GET
H2 200 4d62acb667fb.png
www.instagram.com/static/images/homepage/screenshots/screenshot2.png/ 55 KB
55 KB 680ms
653ms Image
image/png 2a03:2880:f276:1e9:face:b00c:0:4420
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.instagram.com/static/images/homepage/screenshots/screenshot2.png/4d62acb667fb.png
Requested by: Host: www.filesusr.com
URL: https://www.filesusr.com/html/ca29a3_bf6671138bd57af9b3b1ede7eb701f0e.html?987217*bWF0YXRyb2xlczUwMDBAZ21haWwuY29t*https://www.surveymonkey.com/r/SYRY2RS**Instagram
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f276:1e9:face:b00c:0:4420 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 29c503acf8430c22bf525a0c518600573c885c64e2098f34a04e8788fffceb6e

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.filesusr.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 21:15:27 GMT
content-encoding: br
x-fb-load: 404
etag: "4d62acb667fb"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
edge-control: max-age=1209600, no-transform
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
content-length: 56239

GET
H2 200 94edb770accf.png
www.instagram.com/static/images/homepage/screenshots/screenshot3.png/ 148 KB
149 KB 324ms
298ms Image
image/png 2a03:2880:f276:1e9:face:b00c:0:4420
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.instagram.com/static/images/homepage/screenshots/screenshot3.png/94edb770accf.png
Requested by: Host: www.filesusr.com
URL: https://www.filesusr.com/html/ca29a3_bf6671138bd57af9b3b1ede7eb701f0e.html?987217*bWF0YXRyb2xlczUwMDBAZ21haWwuY29t*https://www.surveymonkey.com/r/SYRY2RS**Instagram
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f276:1e9:face:b00c:0:4420 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 7b9eea4b38cd8ef980f06f77a5d24ca0c2da44e1970f5696c892f8f47fb16526

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.filesusr.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 21:15:27 GMT
content-encoding: br
x-fb-load: 369
etag: "94edb770accf"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
edge-control: max-age=1209600, no-transform
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
content-length: 151697

GET
H2 200 a4fd825e3d49.png
www.instagram.com/static/images/homepage/screenshots/screenshot4.png/ 231 KB
232 KB 593ms
566ms Image
image/png 2a03:2880:f276:1e9:face:b00c:0:4420
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.instagram.com/static/images/homepage/screenshots/screenshot4.png/a4fd825e3d49.png
Requested by: Host: www.filesusr.com
URL: https://www.filesusr.com/html/ca29a3_bf6671138bd57af9b3b1ede7eb701f0e.html?987217*bWF0YXRyb2xlczUwMDBAZ21haWwuY29t*https://www.surveymonkey.com/r/SYRY2RS**Instagram
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f276:1e9:face:b00c:0:4420 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 8afbe7fe66756b949187ba3af1dbe6ffaece09aad07a3162b76334836db87637

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.filesusr.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 21:15:27 GMT
content-encoding: br
x-fb-load: 344
etag: "a4fd825e3d49"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
edge-control: max-age=1209600, no-transform
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
content-length: 236931

GET
H2 200 e2247c4f90de.png
www.instagram.com/static/images/appstore-install-badges/badge_ios_spanish_latinamerica_mexico.png/ 4 KB
4 KB 289ms
263ms Image
image/png 2a03:2880:f276:1e9:face:b00c:0:4420
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.instagram.com/static/images/appstore-install-badges/badge_ios_spanish_latinamerica_mexico.png/e2247c4f90de.png
Requested by: Host: www.filesusr.com
URL: https://www.filesusr.com/html/ca29a3_bf6671138bd57af9b3b1ede7eb701f0e.html?987217*bWF0YXRyb2xlczUwMDBAZ21haWwuY29t*https://www.surveymonkey.com/r/SYRY2RS**Instagram
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f276:1e9:face:b00c:0:4420 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 93bde1855cd2f2ce93ae1e63bdb4cc531dc74d98bfb85803cc8d3aaf7e193d3a

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.filesusr.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 21:15:27 GMT
content-encoding: br
x-fb-load: 397
etag: "e2247c4f90de"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
edge-control: max-age=1209600, no-transform
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
content-length: 3569

GET
H2 200 3cd8a27083c0.png
www.instagram.com/static/images/appstore-install-badges/badge_android_spanish_latinamerica_mexico-es_LA.png/ 10 KB
10 KB 34ms
9ms Image
image/png 2a03:2880:f276:1e9:face:b00c:0:4420
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.instagram.com/static/images/appstore-install-badges/badge_android_spanish_latinamerica_mexico-es_LA.png/3cd8a27083c0.png
Requested by: Host: www.filesusr.com
URL: https://www.filesusr.com/html/ca29a3_bf6671138bd57af9b3b1ede7eb701f0e.html?987217*bWF0YXRyb2xlczUwMDBAZ21haWwuY29t*https://www.surveymonkey.com/r/SYRY2RS**Instagram
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f276:1e9:face:b00c:0:4420 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 272a0e710126ac27b2e914a8ae44c5e02105eca853cfa87467883ab432d7cd5e

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.filesusr.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 14:38:52 GMT
content-encoding: br
x-fb-load: 553
etag: "3cd8a27083c0"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
edge-control: max-age=1209600, no-transform
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
content-length: 10471

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.12.4/ 95 KB
34 KB 57ms
7ms Script
text/javascript 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.filesusr.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 16 May 2024 09:57:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 127068
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33951
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 16 May 2025 09:57:38 GMT

GET
H2 200 1dc085cdb87d.png
www.instagram.com/static/images/homepage/phones/home-phones.png/ 109 KB
109 KB 9ms
8ms Image
image/png 2a03:2880:f276:1e9:face:b00c:0:4420
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.instagram.com/static/images/homepage/phones/home-phones.png/1dc085cdb87d.png
Requested by: Host: www.filesusr.com
URL: https://www.filesusr.com/html/ca29a3_bf6671138bd57af9b3b1ede7eb701f0e.html?987217*bWF0YXRyb2xlczUwMDBAZ21haWwuY29t*https://www.surveymonkey.com/r/SYRY2RS**Instagram
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f276:1e9:face:b00c:0:4420 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 3bac9eb2e86c3617651a5e20ad8204c867f7625fb7142affaa85ec5ff2671c7b

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.filesusr.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 16 May 2024 23:12:58 GMT
content-encoding: br
x-fb-load: 367
etag: "1dc085cdb87d"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
edge-control: max-age=1209600, no-transform
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
content-length: 111659

GET
H2 200 32f0a4f27407.png
www.instagram.com/static/bundles/es6/sprite_core_32f0a4f27407.png/ 75 KB
75 KB 9ms
8ms Image
image/png 2a03:2880:f276:1e9:face:b00c:0:4420
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.instagram.com/static/bundles/es6/sprite_core_32f0a4f27407.png/32f0a4f27407.png
Requested by: Host: www.filesusr.com
URL: https://www.filesusr.com/html/ca29a3_bf6671138bd57af9b3b1ede7eb701f0e.html?987217*bWF0YXRyb2xlczUwMDBAZ21haWwuY29t*https://www.surveymonkey.com/r/SYRY2RS**Instagram
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f276:1e9:face:b00c:0:4420 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 12f4c816adc97f7808a7746329451a4b3fbbc8e8a67bd1337984e6ab6079c6a1

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.filesusr.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 04 May 2024 15:09:56 GMT
content-encoding: br
x-fb-load: 500
etag: "32f0a4f27407"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
edge-control: max-age=1209600, no-transform
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
content-length: 76376

GET
H3 200 favicon-ig.ico
exploits-fr.com/blogger/assets/images/ 5 KB
4 KB 469ms
279ms Other
image/x-icon 172.67.191.13
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://exploits-fr.com/blogger/assets/images/favicon-ig.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.191.13 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0d3b03b6b3a5d8d93f2e8e420352906459a9df4a19a34accac281e7ef1d07856

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.filesusr.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 21:15:28 GMT
content-encoding: gzip
cf-cache-status: MISS
last-modified: Thu, 24 Aug 2017 23:53:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=35RGnnpdW7zDiz2kQH%2BDlEkuI%2BGZyLOW6eKGYlOcLMt0FRk4ezvFWI2b8zGhZBErZk4Fas469U%2BVDXDbosG7mP%2Fa3CYOofposlJvIlap2%2FdflIrrqa%2F4mG2umR9VPTADv1E%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/x-icon
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 88569f7b7d14973c-FRA
alt-svc: h3=":443"; ma=86400
content-length: 4089

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: unpkg.com
URL: https://unpkg.com/vue@next

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Instagram (Social Network)

26 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.tinyurl.com/	1970-01-20 20:39:42	Name: __cf_bm Value: ytc498YrUn4YuXt9yNfZQIKBKb_wKSPUlniW4vUlSMw-1715980525-1.0.1.1-HOr0q_q_7Q2UnWTAEFrp9QJiDaegbA2Y8ynp4nO5RbrkCWYxAN2pPKAmGdi2fhbL3g5uOpUcQtxzsbcXFWf7qw

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://www.filesusr.com/html/ca29a3_bf6671138bd57af9b3b1ede7eb701f0e.html?987217bWF0YXRyb2xlczUwMDBAZ21haWwuY29thttps://www.surveymonkey.com/r/SYRY2RSInstagram(Line 46) Message**: A parser-blocking, cross site (i.e. different eTLD+1) script, https://unpkg.com/vue@next, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://www.filesusr.com/html/ca29a3_bf6671138bd57af9b3b1ede7eb701f0e.html?987217bWF0YXRyb2xlczUwMDBAZ21haWwuY29thttps://www.surveymonkey.com/r/SYRY2RSInstagram(Line 46) Message**: A parser-blocking, cross site (i.e. different eTLD+1) script, https://unpkg.com/vue@next, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://www.filesusr.com/html/ca29a3_bf6671138bd57af9b3b1ede7eb701f0e.html?987217bWF0YXRyb2xlczUwMDBAZ21haWwuY29thttps://www.surveymonkey.com/r/SYRY2RSInstagram(Line 46) Message**: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
exploits-fr.com
tinyurl.com
unpkg.com
www.blogger.com
www.filesusr.com
www.instagram.com
www.tinyurl.com
unpkg.com
172.67.1.225
172.67.191.13
2600:9000:2490:c000:0:7dcd:9780:93a1
2a00:1450:4001:813::2009
2a00:1450:4001:830::200a
2a03:2880:f276:1e9:face:b00c:0:4420
0d3b03b6b3a5d8d93f2e8e420352906459a9df4a19a34accac281e7ef1d07856
12f4c816adc97f7808a7746329451a4b3fbbc8e8a67bd1337984e6ab6079c6a1
1a2eca9e492e3a21e02dd77ad44d7af45c4091d35ede79e948b7a3f23e5b3617
272a0e710126ac27b2e914a8ae44c5e02105eca853cfa87467883ab432d7cd5e
29c503acf8430c22bf525a0c518600573c885c64e2098f34a04e8788fffceb6e
3bac9eb2e86c3617651a5e20ad8204c867f7625fb7142affaa85ec5ff2671c7b
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
765601709b703cd426bea3c604efc4a3efcf22e886eb8b78f4521b5d5f8d0482
7b9eea4b38cd8ef980f06f77a5d24ca0c2da44e1970f5696c892f8f47fb16526
8afbe7fe66756b949187ba3af1dbe6ffaece09aad07a3162b76334836db87637
93bde1855cd2f2ce93ae1e63bdb4cc531dc74d98bfb85803cc8d3aaf7e193d3a
9a70a7b2974cd3af3bfb572fe5a4b01bb93e25fe3dd0a4cd6a411912508050c3
9ff801298d1af2640890052e2ff88045f3f9740c268bc969c5bc02bbac5ec862

www.filesusr.com Open in urlscan Pro 2600:9000:2490:c000:0:7dcd:9780:93a1 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

14 Requests

93 %HTTPS

67 %IPv6

7 Domains

8 Subdomains

6 IPs

2 Countries

5376 kBTransfer

5482 kBSize

1 Cookies

5 Outgoing links

Page URL History

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

26 JavaScript Global Variables

1 Cookies

3 Console Messages

Indicators

www.filesusr.com Open in urlscan Pro
2600:9000:2490:c000:0:7dcd:9780:93a1 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

93 %
HTTPS

67 %
IPv6

7
Domains

8
Subdomains

6
IPs

2
Countries

5376 kB
Transfer

5482 kB
Size

1
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!