instagramuserhelp.com

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 4 HTTP transactions. The main IP is 95.181.155.103, located in Russian Federation and belongs to MSKHOST, RU. The main domain is instagramuserhelp.com.

This is the only time instagramuserhelp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Instagram (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
2	95.181.155.103 95.181.155.103	207319 (MSKHOST) (MSKHOST)
1	2620:0:862:ed... 2620:0:862:ed1a::2:b	14907 (WIKIMEDIA) (WIKIMEDIA)
1	2606:4700:303... 2606:4700:3034::ac43:c38e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	3

2 95.181.155.103 (Russian Federation)

ASN207319 (MSKHOST, RU)
PTR: server1.host.biz.tr

instagramuserhelp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:0:862:ed1a::2:b (United States)

ASN14907 (WIKIMEDIA, US)

upload.wikimedia.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3034::ac43:c38e (United States)

ASN13335 (CLOUDFLARENET, US)

www.resimag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	instagramuserhelp.com instagramuserhelp.com	6 KB
1	resimag.com www.resimag.com	12 KB
1	wikimedia.org upload.wikimedia.org	62 KB
4	3

	Domain	Requested by
2	instagramuserhelp.com	instagramuserhelp.com
1	www.resimag.com	instagramuserhelp.com
1	upload.wikimedia.org	instagramuserhelp.com
4	3

This site contains no links.

Subject Issuer	Validity	Valid
*.wikipedia.org Let's Encrypt Authority X3	`2020-09-18` - `2020-12-17`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-07-07` - `2021-07-07`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://instagramuserhelp.com/
Frame ID: 824D5585975842CCADBD8FB17C4EE5E6
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

Page Statistics

4
Requests

50 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

81 kB
Transfer

80 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
instagramuserhelp.com/ 2 KB
1 KB 307ms
172ms Document
text/html 95.181.155.103
MSKHOST

General

Check archive.org

Show headers Download Go to

Full URL: http://instagramuserhelp.com/
Protocol: HTTP/1.1
Server: 95.181.155.103 , Russian Federation, ASN207319 (MSKHOST, RU),
Reverse DNS: server1.host.biz.tr
Software: LiteSpeed /
Resource Hash: 261d207d1559422fab9ab6ab4e4201a05a22b768c8b287bb89cd017f139d1aac

Request headers

Host: instagramuserhelp.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: text/html; charset=UTF-8
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Length: 1000
Date: Tue, 20 Oct 2020 11:10:12 GMT
Server: LiteSpeed
Connection: Keep-Alive

GET
H/1.1 200
OK xq1.png
instagramuserhelp.com/resim/ 5 KB
5 KB 96ms
95ms Image
image/png 95.181.155.103
MSKHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://instagramuserhelp.com/resim/xq1.png
Requested by: Host: instagramuserhelp.com
URL: http://instagramuserhelp.com/
Protocol: HTTP/1.1
Server: 95.181.155.103 , Russian Federation, ASN207319 (MSKHOST, RU),
Reverse DNS: server1.host.biz.tr
Software: LiteSpeed /
Resource Hash: c8c0e72d2cce08c6c8865bfa1b4623b975f55cc919fc85b5a5580bc08a9658e5

Request headers

Referer: http://instagramuserhelp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 20 Oct 2020 11:10:12 GMT
Last-Modified: Tue, 20 Oct 2020 08:15:47 GMT
Server: LiteSpeed
Etag: "1228-5f8e9cb3-203762d;;;"
Content-Type: image/png
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 4648
Expires: Tue, 27 Oct 2020 11:10:12 GMT

GET
H2 200 1200px-Instagram_new.svg.png
upload.wikimedia.org/wikipedia/commons/thumb/9/95/Instagram_new.svg/ 62 KB
62 KB 53ms
25ms Image
image/png 2620:0:862:ed1a::2:b
WIKIMEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://upload.wikimedia.org/wikipedia/commons/thumb/9/95/Instagram_new.svg/1200px-Instagram_new.svg.png

Requested by

Host: instagramuserhelp.com
URL: http://instagramuserhelp.com/

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

2620:0:862:ed1a::2:b , United States, ASN14907 (WIKIMEDIA, US),

Reverse DNS

Software

ATS/8.0.8 /

Resource Hash

4e390a4a282403c2daf802fe940916ff8064a460c10be19dfa9b603df20aa497

Security Headers

Name	Value
Strict-Transport-Security	max-age=106384710; includeSubDomains; preload

Request headers

Referer: http://instagramuserhelp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 19 Oct 2020 15:04:27 GMT
nel: { "report_to": "wm_nel", "max_age": 86400, "failure_fraction": 0.05, "success_fraction": 0.0}
age: 72345
x-cache-status: hit-front
x-cache: cp3055 hit, cp3061 hit/82
status: 200
server-timing: cache;desc="hit-front"
content-length: 63143
x-client-ip: 2a01:4f8:192:5414::2
last-modified: Sun, 24 Dec 2017 17:19:39 GMT
server: ATS/8.0.8
etag: 24ae7140ef6bb03a33a8ea6e36a55775
strict-transport-security: max-age=106384710; includeSubDomains; preload
report-to: { "group": "wm_nel", "max_age": 86400, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] }
content-type: image/png
access-control-allow-origin: *
x-timestamp: 1514135978.13911
accept-ranges: bytes
timing-allow-origin: *
access-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache

GET
H2 200 b2522b65d22.jpeg
www.resimag.com/p1/ 12 KB
12 KB 81ms
54ms Image
image/jpeg 2606:4700:3034::ac43:c38e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.resimag.com/p1/b2522b65d22.jpeg
Requested by: Host: instagramuserhelp.com
URL: http://instagramuserhelp.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:c38e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 1576137033a00728a1dda43edd3c10ea4b8c438cb481bb8c76568596a1375549

Request headers

Referer: http://instagramuserhelp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 20 Oct 2020 11:10:12 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-powered-by: PleskLin
status: 200
content-length: 12125
cf-request-id: 05e74ce3dc0000073e04a2c000000001
pragma: no-cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603192212"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes
cf-ray: 5e524a7fced4073e-FRA
expires: Mon, 10 Apr 1972 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Instagram (Social Network)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

instagramuserhelp.com
upload.wikimedia.org
www.resimag.com
2606:4700:3034::ac43:c38e
2620:0:862:ed1a::2:b
95.181.155.103
1576137033a00728a1dda43edd3c10ea4b8c438cb481bb8c76568596a1375549
261d207d1559422fab9ab6ab4e4201a05a22b768c8b287bb89cd017f139d1aac
4e390a4a282403c2daf802fe940916ff8064a460c10be19dfa9b603df20aa497
c8c0e72d2cce08c6c8865bfa1b4623b975f55cc919fc85b5a5580bc08a9658e5

instagramuserhelp.com Open in urlscan Pro 95.181.155.103 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

4 Requests

50 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

81 kBTransfer

80 kBSize

0 Cookies

0 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

instagramuserhelp.com Open in urlscan Pro
95.181.155.103 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

50 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

81 kB
Transfer

80 kB
Size

0
Cookies

4 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!