instagram-verify-helper.ga Open in urlscan Pro
2606:4700:3035::6815:303c  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response instagram-verify-helper.ga/	3 KB 2 KB	314ms 274ms	Document text/html	2606:4700:3035::6815:303c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://instagram-verify-helper.ga/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:303c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/5.6.38 ASP.NET Resource Hash 949b39e1daefb30d0d2a00593b049b01d2370b4ab3e7c8a8d81b413fe9615dcf Request headers :method GET :authority instagram-verify-helper.ga :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 21 Jan 2021 05:28:44 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=d8cc17c1f4f520d0a9a3860edf83eded31611206924; expires=Sat, 20-Feb-21 05:28:44 GMT; path=/; domain=.instagram-verify-helper.ga; HttpOnly; SameSite=Lax; Secure ARRAffinity=b8c2dae333b96a082c903670627ab7d3a60f8fcbd1e518dcf846303870e31e5d;Path=/;Domain=instagram-verify-helper.ga vary Accept-Encoding x-powered-by PHP/5.6.38 ASP.NET cf-cache-status DYNAMIC cf-request-id 07c503af9200002b1a49b15000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Z51nEI%2B3pw3AQF4e4cWuZ3sANHTZ9DBTqLoCGGuT9l%2F7MLU%2FclcFa7Y7dUplr%2F9BBLKcnOfXi7qWXxXFvFZlxkDMNPFO1I3Onf1GpDFX2WEMUOnk0cmB7GzBY9Lf10AAIGEzRGJB%2BQ%3D%3D"}]} nel {"max_age":604800,"report_to":"cf-nel"} server cloudflare cf-ray 614ea22c1e5a2b1a-FRA content-encoding br
GET H2	200	sKqXcB7zDP7N-6yY75yXsKOC97B-g-pZSdkWFTKh02EVUCA277wXPS-5JGPMeRBHAKdRtnZv=s0-d-e1-ft ci4.googleusercontent.com/proxy/	785 KB 786 KB	796ms 776ms	Image image/gif	2a00:1450:4001:814::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ci4.googleusercontent.com/proxy/sKqXcB7zDP7N-6yY75yXsKOC97B-g-pZSdkWFTKh02EVUCA277wXPS-5JGPMeRBHAKdRtnZv=s0-d-e1-ft Requested by Host: instagram-verify-helper.ga URL: https://instagram-verify-helper.ga/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software fife / Resource Hash 34b405bf58c292a06f7e755b46ff12cfaf230d5f4a0f6368298c63e1c76f25fc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://instagram-verify-helper.ga/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 21 Jan 2021 05:28:45 GMT x-content-type-options nosniff server fife vary Origin content-type image/gif access-control-allow-origin * access-control-expose-headers Content-Length cache-control max-age=31556926 content-disposition attachment;filename="unnamed.gif" timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 803583 x-xss-protection 0
GET H2	200	1280px-Facebook_Logo_%282019%29.svg.png upload.wikimedia.org/wikipedia/commons/thumb/8/89/Facebook_Logo_%282019%29.svg/	31 KB 31 KB	40ms 14ms	Image image/png	2620:0:862:ed1a::2:b WIKIMEDIA
General Check archive.org Show headers Download Go to Show image Full URL https://upload.wikimedia.org/wikipedia/commons/thumb/8/89/Facebook_Logo_%282019%29.svg/1280px-Facebook_Logo_%282019%29.svg.png Requested by Host: instagram-verify-helper.ga URL: https://instagram-verify-helper.ga/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:0:862:ed1a::2:b , United States, ASN14907 (WIKIMEDIA, US), Reverse DNS Software ATS/8.0.8 / Resource Hash 53e72c513451cb057f5b2f626d2d02628c7c5950a5363cf54c5112172f0bcf45 Security Headers Name Value Strict-Transport-Security max-age=106384710; includeSubDomains; preload Request headers Referer https://instagram-verify-helper.ga/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 20 Jan 2021 09:40:09 GMT nel { "report_to": "wm_nel", "max_age": 86400, "failure_fraction": 0.05, "success_fraction": 0.0} age 71314 x-cache-status hit-front x-cache cp3057 hit, cp3063 hit/17 server-timing cache;desc="hit-front" content-length 31586 x-client-ip 2a01:4f8:192:5414::2 last-modified Sun, 02 Aug 2020 17:41:31 GMT server ATS/8.0.8 etag 07b86fa24295f2f86a4021150d5b2c2d strict-transport-security max-age=106384710; includeSubDomains; preload report-to { "group": "wm_nel", "max_age": 86400, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] } content-type image/png access-control-allow-origin * x-timestamp 1596390090.88640 accept-ranges bytes timing-allow-origin * access-control-expose-headers Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Instagram (Social Network)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.instagram-verify-helper.ga/	1969-12-31 23:59:59	Name: ARRAffinity Value: b8c2dae333b96a082c903670627ab7d3a60f8fcbd1e518dcf846303870e31e5d
			.instagram-verify-helper.ga/	1970-01-19 16:16:38	Name: __cfduid Value: d8cc17c1f4f520d0a9a3860edf83eded31611206924

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ci4.googleusercontent.com
instagram-verify-helper.ga
upload.wikimedia.org
2606:4700:3035::6815:303c
2620:0:862:ed1a::2:b
2a00:1450:4001:814::2001
34b405bf58c292a06f7e755b46ff12cfaf230d5f4a0f6368298c63e1c76f25fc
53e72c513451cb057f5b2f626d2d02628c7c5950a5363cf54c5112172f0bcf45
949b39e1daefb30d0d2a00593b049b01d2370b4ab3e7c8a8d81b413fe9615dcf