feedbackforinstagram.com Open in urlscan Pro
3.20.85.248  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response feedbackforinstagram.com/	5 KB 2 KB	327ms 108ms	Document text/html	3.20.85.248 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://feedbackforinstagram.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.20.85.248 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-20-85-248.us-east-2.compute.amazonaws.com Software LiteSpeed / Resource Hash a2506319fb0740563b4a5eb23dec7a5c68bc54c769f3a2848f91785e4f1d070b Request headers :method GET :authority feedbackforinstagram.com :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-type text/html; charset=UTF-8 content-encoding gzip vary Accept-Encoding content-length 1889 date Thu, 19 Nov 2020 17:25:23 GMT server LiteSpeed alt-svc quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
GET H2	200	instagram-600-followers.png sonerdoganyilmaz.com/wp-content/uploads/2018/01/	119 KB 120 KB	313ms 83ms	Image image/png	185.8.128.201 ALASTYR
General Check archive.org Show headers Download Go to Show image Full URL https://sonerdoganyilmaz.com/wp-content/uploads/2018/01/instagram-600-followers.png Requested by Host: feedbackforinstagram.com URL: https://feedbackforinstagram.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.8.128.201 , Turkey, ASN3188 (ALASTYR, TR), Reverse DNS eros.alastyr.com Software LiteSpeed / Resource Hash 0639c04760ae61b00b302d5168eb6aaf84d32cadcf09d01abf0b2f7d9e0f9a2d Request headers Referer https://feedbackforinstagram.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 19 Nov 2020 17:25:18 GMT last-modified Tue, 02 Jan 2018 13:50:44 GMT server LiteSpeed content-type image/png cache-control max-age=3600, public accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000 content-length 122242 expires Thu, 26 Nov 2020 17:25:18 GMT
GET H2	200	night-mode-2-475098.png cdn.iconscout.com/icon/free/png-256/	1 KB 2 KB	66ms 42ms	Image image/webp	2606:4700::6812:1df3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.iconscout.com/icon/free/png-256/night-mode-2-475098.png Requested by Host: feedbackforinstagram.com URL: https://feedbackforinstagram.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1df3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 908f5cf7b4b2a4b9a82a4bff52abf6abbf75d80c2169030ea0fe56186fa661ad Request headers Referer https://feedbackforinstagram.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 19 Nov 2020 17:25:23 GMT cf-cache-status HIT age 288936 cf-polished origFmt=png, origSize=3235 content-disposition inline; filename="night-mode-2-475098.webp" content-length 1528 cf-request-id 0683232917000005ed673f3000000001 expires Fri, 19 Nov 2021 17:25:23 GMT last-modified Wed, 05 Feb 2020 04:46:57 GMT server cloudflare etag "cb24de56ffb2ecfe5becaed75f3d3dd9" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept access-control-allow-methods GET, POST, OPTIONS content-type image/webp access-control-allow-origin * access-control-expose-headers Content-Length,Content-Range cache-control public, max-age=31536000 x-amz-meta-fl-original-last-modified 2018-07-19T22:59:52Z accept-ranges bytes cf-ray 5f4ba154f98f05ed-FRA access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Accept,X-CSRF-TOKEN,Authorization,Client-ID cf-bgj imgq:100,h2pri
GET H2	200	9fc4bab7565b.png instagram.com/static/images/ico/xxxhdpi_launcher.png/	14 KB 14 KB	477ms 270ms	Image image/png	2406:da00:ff00::3400:d490 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://instagram.com/static/images/ico/xxxhdpi_launcher.png/9fc4bab7565b.png Requested by Host: feedbackforinstagram.com URL: https://feedbackforinstagram.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2406:da00:ff00::3400:d490 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software / Resource Hash 513bc757c30ee167e2f2a8c0792b16627800d85a33d4657b520cf255ba1a6e00 Request headers Referer https://feedbackforinstagram.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 19 Nov 2020 17:25:23 GMT content-encoding br etag "9fc4bab7565b" vary Accept-Encoding content-type image/png access-control-allow-origin * edge-control max-age=1209600, no-transform cache-control public,max-age=31536000,immutable alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 14131
GET H2	200	Facebook-Logo.png marka-logo.com/wp-content/uploads/2020/04/	34 KB 34 KB	98ms 31ms	Image image/png	45.82.68.161 Netherlands
General Check archive.org Show headers Download Go to Show image Full URL https://marka-logo.com/wp-content/uploads/2020/04/Facebook-Logo.png Requested by Host: feedbackforinstagram.com URL: https://feedbackforinstagram.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305 Server 45.82.68.161 Seattle, United States, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL), Reverse DNS erreurs.net Software nginx/1.18.0 / Resource Hash 4c403fc26b9b547d1a430fec0f1c2fc07bcd001a5ac82867c017347f0f6e4c19 Request headers Referer https://feedbackforinstagram.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 19 Nov 2020 17:25:23 GMT last-modified Wed, 08 Apr 2020 18:24:35 GMT server nginx/1.18.0 etag "5e8e16e3-88e8" content-type image/png cache-control max-age=432000 accept-ranges bytes content-length 35048 expires Tue, 24 Nov 2020 17:25:23 GMT
GET H2	200	Ir160h.jpg i.imgyukle.com/2020/10/21/	46 KB 46 KB	108ms 36ms	Image image/jpeg	116.202.246.29 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgyukle.com/2020/10/21/Ir160h.jpg Requested by Host: feedbackforinstagram.com URL: https://feedbackforinstagram.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 116.202.246.29 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.29.246.202.116.clients.your-server.de Software nginx / Resource Hash 8048c564de6e017d2cdc5ee32974a3c946c0520f7080d2739789d200c4b230e1 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=15768000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://feedbackforinstagram.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 19 Nov 2020 17:25:23 GMT referrer-policy origin last-modified Wed, 21 Oct 2020 08:20:19 GMT server nginx etag "5f8fef43-b650" x-frame-options SAMEORIGIN content-type image/jpeg x-xss-protection 1; mode=block x-permitted-cross-domain-policies master-only feature-policy geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none; content-security-policy frame-ancestors 'self'; strict-transport-security max-age=15768000; includeSubDomains accept-ranges bytes content-length 46672 x-content-type-options nosniff

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Instagram (Social Network) Facebook (Social Network)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| myFunction function| felonyqenzy

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://feedbackforinstagram.com/(Line 207) Message: asdsa
console-api	log	URL: https://feedbackforinstagram.com/(Line 208) Message: feedbackforinstagram.com

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.iconscout.com
feedbackforinstagram.com
i.imgyukle.com
instagram.com
marka-logo.com
sonerdoganyilmaz.com
116.202.246.29
185.8.128.201
2406:da00:ff00::3400:d490
2606:4700::6812:1df3
3.20.85.248
45.82.68.161
0639c04760ae61b00b302d5168eb6aaf84d32cadcf09d01abf0b2f7d9e0f9a2d
4c403fc26b9b547d1a430fec0f1c2fc07bcd001a5ac82867c017347f0f6e4c19
513bc757c30ee167e2f2a8c0792b16627800d85a33d4657b520cf255ba1a6e00
8048c564de6e017d2cdc5ee32974a3c946c0520f7080d2739789d200c4b230e1
908f5cf7b4b2a4b9a82a4bff52abf6abbf75d80c2169030ea0fe56186fa661ad
a2506319fb0740563b4a5eb23dec7a5c68bc54c769f3a2848f91785e4f1d070b