help-instagram-verifybadges.cf Open in urlscan Pro
2606:4700:3036::6818:7c8a  Malicious Activity! Public Scan

URL: https://help-instagram-verifybadges.cf/
Submission: On November 06 via automatic, source certstream-suspicious

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 8 HTTP transactions. The main IP is 2606:4700:3036::6818:7c8a, located in United States and belongs to CLOUDFLARENET, US. The main domain is help-instagram-verifybadges.cf.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on November 6th 2020. Valid for: a year.
This is the only time help-instagram-verifybadges.cf was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Instagram (Social Network)

Domain & IP information

IP Address AS Autonomous System
5 2606:4700:303... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
8 3
Domain Requested by
5 help-instagram-verifybadges.cf help-instagram-verifybadges.cf
2 encrypted-tbn0.gstatic.com help-instagram-verifybadges.cf
0 sex-hatti.xyz Failed help-instagram-verifybadges.cf
8 3

This site contains links to these domains. Also see Links.

Domain
www.instagram.com
help.instagram.com
instagram-press.com
Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2020-11-06 -
2021-11-05
a year crt.sh
*.gstatic.com
GTS CA 1O1
2020-10-20 -
2021-01-12
3 months crt.sh

This page contains 2 frames:

Primary Page: https://help-instagram-verifybadges.cf/
Frame ID: 0F5CE19B8CA9CB303786BDBDDD401B6E
Requests: 7 HTTP requests in this frame

Frame: https://help-instagram-verifybadges.cf/%c5%9eifreyi%20Yenile%20%e2%80%a2%20Instagram_files/vy-MhgbfL4v.html
Frame ID: 70D96DAB54F6332B9AC08293AF6F26C3
Requests: 1 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Page Statistics

8
Requests

88 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

45 kB
Transfer

156 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
help-instagram-verifybadges.cf/
141 KB
30 KB
Document
General
Full URL
https://help-instagram-verifybadges.cf/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::6818:7c8a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
457fbb3fae80a866399cdc1ff0bbf6df6f0e3d3569ea8b9c6c7010a50fa5a46f

Request headers

:method
GET
:authority
help-instagram-verifybadges.cf
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Fri, 06 Nov 2020 20:31:39 GMT
content-type
text/html
set-cookie
__cfduid=d3bbc0330f10e79d8874be45997efade41604694698; expires=Sun, 06-Dec-20 20:31:38 GMT; path=/; domain=.help-instagram-verifybadges.cf; HttpOnly; SameSite=Lax; Secure
vary
Accept-Encoding
last-modified
Fri, 06 Nov 2020 20:21:59 GMT
cache-control
max-age=2592000, public, proxy-revalidate, public, proxy-revalidate
expires
Sun, 06 Dec 2020 20:31:38 GMT
cf-cache-status
DYNAMIC
cf-request-id
0640db032c00002c4ea1025000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=iWZisY5%2BgJEPBhCmQYqMJCyRC26M544vpQIHToC1jMZSrLEQH1BAhjEgU4N6Y8KpZI56Hai%2FYP5ArnFboeyv4K2UziPrupXenOnvdQKcOoSVuxWnK%2BDwBko1VgbWNIxHW5fROqPnYeoPLq4%3D"}],"group":"cf-nel","max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
5ee1944b6f8f2c4e-FRA
content-encoding
br
log.js
sex-hatti.xyz/log/log/
0
0

2365d044cb94.js.html
help-instagram-verifybadges.cf/%c5%9eifreyi%20Yenile%20%e2%80%a2%20Instagram_files/
1 KB
815 B
Script
General
Full URL
https://help-instagram-verifybadges.cf/%c5%9eifreyi%20Yenile%20%e2%80%a2%20Instagram_files/2365d044cb94.js.html
Requested by
Host: help-instagram-verifybadges.cf
URL: https://help-instagram-verifybadges.cf/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::6818:7c8a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bddca50ea3ae337f7fce72a018aa0bec652b5f89e11a31711fbc78e8216cf1a4

Request headers

Origin
https://help-instagram-verifybadges.cf
Referer
https://help-instagram-verifybadges.cf/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 06 Nov 2020 20:31:39 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Fri, 06 Nov 2020 20:22:21 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2BrtXkKAXY03snDKloaYo5GsUC14nOoA3tklhOk98jzF2RTXdFYp0H4r6HtFREgBVGVmn1SRFU0GsMUBmUr%2BUqCxc0opwuI2U%2BSPXJPczN59IXC1WbM%2F3cz9Ubizb3WogneFNLVWCS4eOAaM%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
status
200
cache-control
max-age=2592000, public, proxy-revalidate, public, proxy-revalidate
nel
{"report_to":"cf-nel","max_age":604800}
cf-ray
5ee1944eb8082c4e-FRA
cf-request-id
0640db053600002c4eb2365000000001
expires
Sun, 06 Dec 2020 20:31:39 GMT
images
encrypted-tbn0.gstatic.com/
5 KB
6 KB
Image
General
Full URL
https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcRcBUKxm-jPyGj0Hr0Z1J7kHkjc3WMAwUZ68qPY81ij1rY9v6Gl
Requested by
Host: help-instagram-verifybadges.cf
URL: https://help-instagram-verifybadges.cf/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f71155ddd886d7d72080a9fc196e5a3b3b529ca826cb3f056b2fc83b20bcac84
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://help-instagram-verifybadges.cf/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 06 Nov 2020 20:31:39 GMT
x-content-type-options
nosniff
last-modified
Sun, 30 Jun 2019 00:32:09 GMT
server
sffe
status
200
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5350
x-xss-protection
0
expires
Sat, 06 Nov 2021 20:31:39 GMT
images
encrypted-tbn0.gstatic.com/
5 KB
5 KB
Image
General
Full URL
https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcTp1P9u9QKSUQbEPmay77ZeqJi12tWgK7LE4AD2la0lkFGLATmx
Requested by
Host: help-instagram-verifybadges.cf
URL: https://help-instagram-verifybadges.cf/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
726e901081b6313e68cd87e2f75faf4589b5782dd3f25e585ce5b8d7ebd7100d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://help-instagram-verifybadges.cf/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 06 Nov 2020 20:31:39 GMT
x-content-type-options
nosniff
last-modified
Sun, 28 Jul 2019 19:04:22 GMT
server
sffe
status
200
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5338
x-xss-protection
0
expires
Sat, 06 Nov 2021 20:31:39 GMT
vy-MhgbfL4v.html
help-instagram-verifybadges.cf/%c5%9eifreyi%20Yenile%20%e2%80%a2%20Instagram_files/ Frame 70D9
1 KB
795 B
Document
General
Full URL
https://help-instagram-verifybadges.cf/%c5%9eifreyi%20Yenile%20%e2%80%a2%20Instagram_files/vy-MhgbfL4v.html
Requested by
Host: help-instagram-verifybadges.cf
URL: https://help-instagram-verifybadges.cf/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::6818:7c8a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bddca50ea3ae337f7fce72a018aa0bec652b5f89e11a31711fbc78e8216cf1a4

Request headers

:method
GET
:authority
help-instagram-verifybadges.cf
:scheme
https
:path
/%c5%9eifreyi%20Yenile%20%e2%80%a2%20Instagram_files/vy-MhgbfL4v.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://help-instagram-verifybadges.cf/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
__cfduid=d3bbc0330f10e79d8874be45997efade41604694698
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://help-instagram-verifybadges.cf/

Response headers

status
200
date
Fri, 06 Nov 2020 20:31:39 GMT
content-type
text/html
vary
Accept-Encoding
last-modified
Fri, 06 Nov 2020 20:22:21 GMT
cache-control
max-age=2592000, public, proxy-revalidate, public, proxy-revalidate
expires
Sun, 06 Dec 2020 20:31:39 GMT
cf-cache-status
DYNAMIC
cf-request-id
0640db054300002c4e910bc000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=VWHQzYY8Q1VnCBFNq1%2FVVezUdzKNFTAgco0wZDYrcYCvQqNrvosUjIQNSFX6t%2FvzJxMaBzb3yR0JybAB1GjjV%2B9sjL7ehh6LOJzBruQzz6hB8hvk9hCvPaew5jhkFV%2FX7wwp56hW6bkRaN4%3D"}],"group":"cf-nel","max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
5ee1944ed83f2c4e-FRA
content-encoding
br
a7aeacb41348.html
help-instagram-verifybadges.cf/static/bundles/metro/sprite_glyphs_a7aeacb41348.png/
1 KB
1 KB
Image
General
Full URL
https://help-instagram-verifybadges.cf/static/bundles/metro/sprite_glyphs_a7aeacb41348.png/a7aeacb41348.html
Requested by
Host: help-instagram-verifybadges.cf
URL: https://help-instagram-verifybadges.cf/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::6818:7c8a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://help-instagram-verifybadges.cf/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 06 Nov 2020 20:31:39 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Fri, 06 Nov 2020 20:22:09 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2F7x54u43Imeiu560rLaf34rBIKDA5w5cQgeO%2FXcoQhxNKkwAq5Icm59C%2BbfHWSlAjlAJ2zoKcpGAEq1C9FMHgXMY8lMOtdGFKWlTxtENkGeJol5%2BX%2BpanMMbz05GWT6YvGJUSmKrBgDG2Qg%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
status
200
cache-control
max-age=2592000, public, proxy-revalidate, public, proxy-revalidate
nel
{"report_to":"cf-nel","max_age":604800}
cf-ray
5ee1944ed8462c4e-FRA
cf-request-id
0640db054400002c4e99b22000000001
expires
Sun, 06 Dec 2020 20:31:39 GMT
f01fcb405c10.html
help-instagram-verifybadges.cf/static/bundles/metro/sprite_core_f01fcb405c10.png/
1 KB
1 KB
Image
General
Full URL
https://help-instagram-verifybadges.cf/static/bundles/metro/sprite_core_f01fcb405c10.png/f01fcb405c10.html
Requested by
Host: help-instagram-verifybadges.cf
URL: https://help-instagram-verifybadges.cf/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::6818:7c8a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://help-instagram-verifybadges.cf/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 06 Nov 2020 20:31:39 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Fri, 06 Nov 2020 20:22:06 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=1itbRXEr86w0s3i65WKdvuFjRRcCPsUy5l0nV4HJ8CgzkV%2Flg8AkhQ1VyKO0jjJrVrjLL8It0hMJz8yGWxnLGL6JaEc02unvzZTJoQwWoX62p5R2bwS%2BY9kbevSYu32p67Nz8awsjz8VDAc%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
status
200
cache-control
max-age=2592000, public, proxy-revalidate, public, proxy-revalidate
nel
{"report_to":"cf-nel","max_age":604800}
cf-ray
5ee1944ed8472c4e-FRA
cf-request-id
0640db054500002c4eb9835000000001
expires
Sun, 06 Dec 2020 20:31:39 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
sex-hatti.xyz
URL
http://sex-hatti.xyz/log/log/log.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Instagram (Social Network)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes string| s string| m

1 Cookies

Domain/Path Name / Value
.help-instagram-verifybadges.cf/ Name: __cfduid
Value: d3bbc0330f10e79d8874be45997efade41604694698