lnstagram.com.statya.comment14.post100300.ru Open in urlscan Pro
95.181.157.243  Malicious Activity! Public Scan

URL: https://lnstagram.com.statya.comment14.post100300.ru/
Submission: On October 22 via automatic, source openphish

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 11 HTTP transactions. The main IP is 95.181.157.243, located in Russian Federation and belongs to MSKHOST, RU. The main domain is lnstagram.com.statya.comment14.post100300.ru.
TLS certificate: Issued by Let's Encrypt Authority X3 on October 19th 2020. Valid for: 3 months.
This is the only time lnstagram.com.statya.comment14.post100300.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Instagram (Social Network)

Domain & IP information

IP Address AS Autonomous System
2 95.181.157.243 207319 (MSKHOST)
8 2a03:2880:f21... 32934 (FACEBOOK)
1 2a00:1450:400... 15169 (GOOGLE)
11 4
Domain Requested by
8 www.instagram.com lnstagram.com.statya.comment14.post100300.ru
www.instagram.com
2 lnstagram.com.statya.comment14.post100300.ru lnstagram.com.statya.comment14.post100300.ru
1 ajax.googleapis.com lnstagram.com.statya.comment14.post100300.ru
11 3

This site contains links to these domains. Also see Links.

Domain
www.instagram.com
itunes.apple.com
play.google.com
help.instagram.com
instagram-press.com
Subject Issuer Validity Valid
lnstagram.com.statya.comment14.post100300.ru
Let's Encrypt Authority X3
2020-10-19 -
2021-01-17
3 months crt.sh
*.www.instagram.com
DigiCert SHA2 High Assurance Server CA
2020-10-10 -
2021-01-08
3 months crt.sh
upload.video.google.com
GTS CA 1O1
2020-10-06 -
2020-12-29
3 months crt.sh

This page contains 1 frames:

Primary Page: https://lnstagram.com.statya.comment14.post100300.ru/
Frame ID: 3A2DBDC207859C43A8D4E38D060403C0
Requests: 12 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

11
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

151 kB
Transfer

335 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
lnstagram.com.statya.comment14.post100300.ru/
11 KB
4 KB
Document
General
Full URL
https://lnstagram.com.statya.comment14.post100300.ru/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.181.157.243 , Russian Federation, ASN207319 (MSKHOST, RU),
Reverse DNS
web.ru.msk.host
Software
nginx/1.16.1 / PHP/7.4.9
Resource Hash
1e87c6e36cb5445c3981128fa945485252204aa0bf5cf2414cbac6b3769c3ee9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;

Request headers

:method
GET
:authority
lnstagram.com.statya.comment14.post100300.ru
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
server
nginx/1.16.1
date
Thu, 22 Oct 2020 13:32:25 GMT
content-type
text/html; charset=UTF-8
x-powered-by
PHP/7.4.9
strict-transport-security
max-age=31536000;
content-encoding
gzip
9159bcc3b7b9.css
www.instagram.com/static/bundles/metro/LoginAndSignupPage.css/
15 KB
3 KB
Stylesheet
General
Full URL
https://www.instagram.com/static/bundles/metro/LoginAndSignupPage.css/9159bcc3b7b9.css
Requested by
Host: lnstagram.com.statya.comment14.post100300.ru
URL: https://lnstagram.com.statya.comment14.post100300.ru/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f21c:81e5:face:b00c:0:4420 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
5efb594617a90c26aa7a9e15226edb296545d24e61e696b77c8a7cb4225f5ba6

Request headers

Referer
https://lnstagram.com.statya.comment14.post100300.ru/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 11 Oct 2020 10:56:55 GMT
x-fb-trip-id
1679558926
status
200
etag
"9159bcc3b7b9"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
edge-control
max-age=1209600, no-transform
cache-control
public,max-age=31536000,immutable
content-encoding
br
content-length
2975
666.jpg
lnstagram.com.statya.comment14.post100300.ru/
2 KB
2 KB
Image
General
Full URL
https://lnstagram.com.statya.comment14.post100300.ru/666.jpg
Requested by
Host: lnstagram.com.statya.comment14.post100300.ru
URL: https://lnstagram.com.statya.comment14.post100300.ru/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.181.157.243 , Russian Federation, ASN207319 (MSKHOST, RU),
Reverse DNS
web.ru.msk.host
Software
nginx/1.16.1 /
Resource Hash
c8e65fb79771ed8756d23504e5cd2458c946a4779962f968cbe929fc3b0c0efa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;

Request headers

Referer
https://lnstagram.com.statya.comment14.post100300.ru/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 22 Oct 2020 13:32:26 GMT
last-modified
Tue, 20 Oct 2020 12:15:41 GMT
server
nginx/1.16.1
etag
"5f8ed4ed-73c"
strict-transport-security
max-age=31536000;
content-type
image/jpeg
status
200
accept-ranges
bytes
content-length
1852
bfba6d0fd6bd.png
www.instagram.com/static/images/appstore-install-badges/badge_ios_russian-ru.png/
3 KB
3 KB
Image
General
Full URL
https://www.instagram.com/static/images/appstore-install-badges/badge_ios_russian-ru.png/bfba6d0fd6bd.png
Requested by
Host: lnstagram.com.statya.comment14.post100300.ru
URL: https://lnstagram.com.statya.comment14.post100300.ru/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f21c:81e5:face:b00c:0:4420 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
32953df0b8cf36634903003593f451fee0923180faf7a64285b8b0bca7223b17

Request headers

Referer
https://lnstagram.com.statya.comment14.post100300.ru/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 21 Oct 2020 18:18:39 GMT
x-fb-trip-id
1679558926
status
200
etag
"bfba6d0fd6bd"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
edge-control
max-age=1209600, no-transform
cache-control
public,max-age=31536000,immutable
content-encoding
br
content-length
3311
4c70948c09f3.png
www.instagram.com/static/images/appstore-install-badges/badge_android_russian-ru.png/
10 KB
10 KB
Image
General
Full URL
https://www.instagram.com/static/images/appstore-install-badges/badge_android_russian-ru.png/4c70948c09f3.png
Requested by
Host: lnstagram.com.statya.comment14.post100300.ru
URL: https://lnstagram.com.statya.comment14.post100300.ru/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f21c:81e5:face:b00c:0:4420 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
d39c9db2f39e4e205e2bd2489261bf7ad8972907404e42a5c991f3cb357651d9

Request headers

Referer
https://lnstagram.com.statya.comment14.post100300.ru/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 21 Oct 2020 18:38:42 GMT
x-fb-trip-id
1679558926
status
200
etag
"4c70948c09f3"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
edge-control
max-age=1209600, no-transform
cache-control
public,max-age=31536000,immutable
content-encoding
br
content-length
10406
ecdeb303e8df.css
www.instagram.com/static/bundles/metro/ConsumerLibCommons.css/
38 B
214 B
Stylesheet
General
Full URL
https://www.instagram.com/static/bundles/metro/ConsumerLibCommons.css/ecdeb303e8df.css
Requested by
Host: lnstagram.com.statya.comment14.post100300.ru
URL: https://lnstagram.com.statya.comment14.post100300.ru/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f21c:81e5:face:b00c:0:4420 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
399326053dbe31a47b18b84d7494aedfe8b89e7a20333ab87057ee493e97b9b5

Request headers

Origin
https://lnstagram.com.statya.comment14.post100300.ru
Referer
https://lnstagram.com.statya.comment14.post100300.ru/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 11 Oct 2020 10:56:55 GMT
x-fb-trip-id
1679558926
status
200
etag
"ecdeb303e8df"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
edge-control
max-age=1209600, no-transform
cache-control
public,max-age=31536000,immutable
content-encoding
br
content-length
42
f8b38ed83ff4.css
www.instagram.com/static/bundles/metro/ConsumerUICommons.css/
90 KB
11 KB
Stylesheet
General
Full URL
https://www.instagram.com/static/bundles/metro/ConsumerUICommons.css/f8b38ed83ff4.css
Requested by
Host: lnstagram.com.statya.comment14.post100300.ru
URL: https://lnstagram.com.statya.comment14.post100300.ru/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f21c:81e5:face:b00c:0:4420 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
77f28e53f63545996003b9e5a49b51b61bf705cd2fdb30d02ae7a0e7e1680935

Request headers

Origin
https://lnstagram.com.statya.comment14.post100300.ru
Referer
https://lnstagram.com.statya.comment14.post100300.ru/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 11 Oct 2020 10:56:56 GMT
x-fb-trip-id
1679558926
status
200
etag
"f8b38ed83ff4"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
edge-control
max-age=1209600, no-transform
cache-control
public,max-age=31536000,immutable
content-encoding
br
content-length
11471
6f451cfba8c9.css
www.instagram.com/static/bundles/metro/ConsumerAsyncCommons.css/
39 KB
13 KB
Stylesheet
General
Full URL
https://www.instagram.com/static/bundles/metro/ConsumerAsyncCommons.css/6f451cfba8c9.css
Requested by
Host: lnstagram.com.statya.comment14.post100300.ru
URL: https://lnstagram.com.statya.comment14.post100300.ru/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f21c:81e5:face:b00c:0:4420 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
81d62cbe6b771c4d3bb049bb2a32b39171531dcd14677a73ed20a19bbc274a3b

Request headers

Origin
https://lnstagram.com.statya.comment14.post100300.ru
Referer
https://lnstagram.com.statya.comment14.post100300.ru/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 15 Oct 2020 13:47:49 GMT
x-fb-trip-id
1679558926
status
200
etag
"6f451cfba8c9"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
edge-control
max-age=1209600, no-transform
cache-control
public,max-age=31536000,immutable
content-encoding
br
content-length
13570
366aad278e6b.css
www.instagram.com/static/bundles/metro/Consumer.css/
6 KB
2 KB
Stylesheet
General
Full URL
https://www.instagram.com/static/bundles/metro/Consumer.css/366aad278e6b.css
Requested by
Host: lnstagram.com.statya.comment14.post100300.ru
URL: https://lnstagram.com.statya.comment14.post100300.ru/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f21c:81e5:face:b00c:0:4420 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
8bdedcd4240cf7fdf42f5c11cffe94ae9eb64032acbd73e17b2fcbfd82aec40e

Request headers

Origin
https://lnstagram.com.statya.comment14.post100300.ru
Referer
https://lnstagram.com.statya.comment14.post100300.ru/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 11 Oct 2020 10:56:55 GMT
x-fb-trip-id
1679558926
status
200
etag
"366aad278e6b"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
edge-control
max-age=1209600, no-transform
cache-control
public,max-age=31536000,immutable
content-encoding
br
content-length
1737
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.0/
84 KB
29 KB
Script
General
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/2.2.0/jquery.min.js
Requested by
Host: lnstagram.com.statya.comment14.post100300.ru
URL: https://lnstagram.com.statya.comment14.post100300.ru/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8a102873a33f24f7eb22221e6b23c4f718e29f85168ecc769a35bfaed9b12cce
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://lnstagram.com.statya.comment14.post100300.ru/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 21 Oct 2020 02:56:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
124571
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
30089
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 21 Oct 2021 02:56:16 GMT
4f48d3d2062b.png
www.instagram.com/static/bundles/metro/sprite_core_4f48d3d2062b.png/
73 KB
73 KB
Image
General
Full URL
https://www.instagram.com/static/bundles/metro/sprite_core_4f48d3d2062b.png/4f48d3d2062b.png
Requested by
Host: www.instagram.com
URL: https://www.instagram.com/static/bundles/metro/ConsumerUICommons.css/f8b38ed83ff4.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f21c:81e5:face:b00c:0:4420 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
4f377056bef3fb09289c1a1d1413f56071c68ec61495bdfcaaf9e291a3db5e42

Request headers

Referer
https://www.instagram.com/static/bundles/metro/ConsumerUICommons.css/f8b38ed83ff4.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 16 Oct 2020 13:15:52 GMT
x-fb-trip-id
1679558926
status
200
etag
"4f48d3d2062b"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
edge-control
max-age=1209600, no-transform
cache-control
public,max-age=31536000,immutable
content-encoding
br
content-length
74401
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ab56951eedd7791b33138ce04d75fffa328d87970b59a8a417089b11cc856754

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Instagram (Social Network)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes function| $ function| jQuery

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000;