URL: http://instagramsec.com/
Submission: On August 02 via automatic, source phishtank

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 12 HTTP transactions. The main IP is 91.92.120.131, located in Bulgaria and belongs to HISTATE, BG. The main domain is instagramsec.com.
This is the only time instagramsec.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Instagram (Social Network)

Domain & IP information

IP Address AS Autonomous System
2 91.92.120.131 206776 (HISTATE)
6 2a02:26f0:78:... 20940 (AKAMAI-ASN1)
4 2a02:26f0:78:... 20940 (AKAMAI-ASN1)
12 3
Apex Domain
Subdomains
Transfer
10 akamaihd.net
instagramstatic-a.akamaihd.net
332 KB
2 instagramsec.com
instagramsec.com
17 KB
12 2
Domain Requested by
10 instagramstatic-a.akamaihd.net instagramsec.com
instagramstatic-a.akamaihd.net
2 instagramsec.com instagramsec.com
12 2

This site contains links to these domains. Also see Links.

Domain
www.instagram.com
itunes.apple.com
play.google.com
help.instagram.com
blog.instagram.com
Subject Issuer Validity Valid
a248.e.akamai.net
Symantec Class 3 ECC 256 bit SSL CA - G2
2017-03-07 -
2018-05-06
a year crt.sh

This page contains 1 frames:

Primary Page: http://instagramsec.com/
Frame ID: 2707.1
Requests: 12 HTTP requests in this frame

Screenshot


Page Statistics

12
Requests

83 %
HTTPS

67 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

350 kB
Transfer

933 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
instagramsec.com/
90 KB
17 KB
Document
General
Full URL
http://instagramsec.com/
Protocol
HTTP/1.1
Server
91.92.120.131 , Bulgaria, ASN206776 (HISTATE, BG),
Reverse DNS
srvr.shared-host.net
Software
LiteSpeed /
Resource Hash
151ba93f46a42aada595dabde6f3206dd19b171ab1a53cd82725676f05686a63

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Wed, 02 Aug 2017 15:12:02 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Aug 2017 12:16:27 GMT
Server
LiteSpeed
Vary
Accept-Encoding
Content-Type
text/html
Connection
close
Accept-Ranges
bytes
Content-Length
17857
c0456c81549b.js
instagramstatic-a.akamaihd.net/h1/scripts/webfont.js/
11 KB
4 KB
Script
General
Full URL
https://instagramstatic-a.akamaihd.net/h1/scripts/webfont.js/c0456c81549b.js
Requested by
Host: instagramsec.com
URL: http://instagramsec.com/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:78::5f64:f872 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
86486fcf3854d5bc36c2270f67ddb903cac60e205c17f3e8b0549f37e3afe1b2

Request headers

Referer
http://instagramsec.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

date
Wed, 02 Aug 2017 15:12:02 GMT
content-encoding
gzip
last-modified
Tue, 26 Jan 2016 19:15:07 GMT
server
AmazonS3
x-amz-request-id
01192FECA61DF0D3
etag
"204291da062ab27897532a402ca68edc"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public,max-age=315360000
accept-ranges
bytes
access-control-allow-origin
*
content-length
4521
x-amz-id-2
wBqcaQYJ9+FI3QoYxR+tit2DEwgGVodJhODtbAtap0lDUstUF7+Vis4NHiLlz230GW3bzBP6dLU=
google_analytics_auto.js
instagramsec.com/
0
0
Script
General
Full URL
http://instagramsec.com/google_analytics_auto.js
Requested by
Host: instagramsec.com
URL: http://instagramsec.com/
Protocol
HTTP/1.1
Server
91.92.120.131 , Bulgaria, ASN206776 (HISTATE, BG),
Reverse DNS
srvr.shared-host.net
Software
LiteSpeed /
Resource Hash

Request headers

Referer
http://instagramsec.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 02 Aug 2017 15:12:02 GMT
Server
LiteSpeed
Content-Type
text/html
Cache-Control
private, no-cache, no-store, must-revalidate, max-age=0
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
1148
4b70f6fae447.png
instagramstatic-a.akamaihd.net/h1/images/appstore-install-badges/badge_ios_english-en.png/
4 KB
4 KB
Image
General
Full URL
https://instagramstatic-a.akamaihd.net/h1/images/appstore-install-badges/badge_ios_english-en.png/4b70f6fae447.png
Requested by
Host: instagramsec.com
URL: http://instagramsec.com/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:78::5f64:f872 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
14c09561486ba385a8a62bc0a8b41e03638a6334648113a7f28be47271eccb5e

Request headers

Referer
http://instagramsec.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

date
Wed, 02 Aug 2017 15:12:03 GMT
content-encoding
gzip
last-modified
Tue, 26 Jan 2016 19:15:05 GMT
server
AmazonS3
x-amz-request-id
1A4933A7A8C7FD89
etag
"dc77a54fdb0c32b3fba555e753e7c5c6"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public,max-age=315360000
accept-ranges
bytes
access-control-allow-origin
*
content-length
3767
x-amz-id-2
l9PZg9jiIib1IyRMhLjgmxJWqQHQPbwgtvjkfVOT1bE6ZwaBAw/mV+Jm7nV3JtrGEY8WzVB8rvA=
74c874cf7dc5.png
instagramstatic-a.akamaihd.net/h1/images/appstore-install-badges/english_get.png/
3 KB
3 KB
Image
General
Full URL
https://instagramstatic-a.akamaihd.net/h1/images/appstore-install-badges/english_get.png/74c874cf7dc5.png
Requested by
Host: instagramsec.com
URL: http://instagramsec.com/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:78::5f64:f872 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8ea3b47463ef1b3d26e05801aba622802112ef166231939db30e3e15e66092b1

Request headers

Referer
http://instagramsec.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

date
Wed, 02 Aug 2017 15:12:03 GMT
content-encoding
gzip
last-modified
Tue, 26 Jan 2016 19:15:05 GMT
server
AmazonS3
x-amz-request-id
F1335CF6E981395A
etag
"b8a69703979522c4f4b3ee9ed587d02e"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public,max-age=315360000
accept-ranges
bytes
access-control-allow-origin
*
content-length
3443
x-amz-id-2
AZnl36dOpRaL0KPCflQUKGIJCxVqQfkgWXpkuYFk8FL01w7C/bj7eWqr8BBNHaPsaGUVlN9twn0=
217deff32421.js
instagramstatic-a.akamaihd.net/h1/bundles/en_US_Commons.js/
239 KB
76 KB
Script
General
Full URL
https://instagramstatic-a.akamaihd.net/h1/bundles/en_US_Commons.js/217deff32421.js
Requested by
Host: instagramsec.com
URL: http://instagramsec.com/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:78::5f64:f872 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
755ad492962d8eeb55ec1db3b9be691ea65f7c91ffeea9ed5eb75f970e321b3f

Request headers

Referer
http://instagramsec.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

date
Wed, 02 Aug 2017 15:12:03 GMT
content-encoding
gzip
last-modified
Tue, 17 May 2016 23:51:01 GMT
server
AmazonS3
x-amz-request-id
AFEEA21832597232
etag
"71b30fbf2ee0b9bc3e9a3332553a1172"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public,max-age=315360000
accept-ranges
bytes
access-control-allow-origin
*
content-length
77183
x-amz-id-2
d/2Q+eIs/KzHdV98bOLBq798Nt4GD++B7q0v49Mkx23hw42ZLSX3Mx+1aIwikpBvV3EhA9w8Nng=
3c793bf38651.js
instagramstatic-a.akamaihd.net/h1/bundles/en_US_LandingPage.js/
453 KB
115 KB
Script
General
Full URL
https://instagramstatic-a.akamaihd.net/h1/bundles/en_US_LandingPage.js/3c793bf38651.js
Requested by
Host: instagramsec.com
URL: http://instagramsec.com/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:78::5f64:f872 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2981466c09c16aac21809c633a8a927cfa429bd1b3af0327357648e141945e2c

Request headers

Referer
http://instagramsec.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

date
Wed, 02 Aug 2017 15:12:03 GMT
content-encoding
gzip
last-modified
Tue, 17 May 2016 23:51:00 GMT
server
AmazonS3
x-amz-request-id
4B6688F55978CD67
etag
"7d5d24dca21326696f562c7989a9cb85"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public,max-age=315360000
accept-ranges
bytes
access-control-allow-origin
*
content-length
117483
x-amz-id-2
ZDAwB42M3Pfw3r4/A2OINzhMXbtDUTKhqrgOXhmBmgZKcsIMS2g7AmMnPRel19VEisuL/HwNK3o=
66bbe029f180.woff
instagramstatic-a.akamaihd.net/h1/webfonts/proximanova-light-webfont.woff/
26 KB
26 KB
Font
General
Full URL
https://instagramstatic-a.akamaihd.net/h1/webfonts/proximanova-light-webfont.woff/66bbe029f180.woff
Requested by
Host: instagramstatic-a.akamaihd.net
URL: https://instagramstatic-a.akamaihd.net/h1/scripts/webfont.js/c0456c81549b.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:78::5f64:f89b , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
37c3bec1bb96a5c0e5fa2fdd0fb122b0405d36f2dc491373afa04c8ac985bf4c

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36
Referer
http://instagramsec.com/
Origin
http://instagramsec.com

Response headers

date
Wed, 02 Aug 2017 15:12:02 GMT
content-encoding
gzip
last-modified
Tue, 26 Jan 2016 19:15:09 GMT
server
AmazonS3
x-amz-request-id
CBD27DACC8E61CAE
etag
"0828392b19f7398035240c2652067ac6"
vary
Accept-Encoding
content-type
application/x-font-woff
status
200
cache-control
public,max-age=315360000
accept-ranges
bytes
access-control-allow-origin
*
content-length
26362
x-amz-id-2
CXkoQarZEcnKQKTXTduW3RRxKPNdRwZDm96XRtRLPQcxybWQogjmWWDGKTPueOAcOtHk4IgUmEk=
a9a9773b8e29.woff
instagramstatic-a.akamaihd.net/h1/webfonts/proximanova-reg-webfont.woff/
13 KB
13 KB
Font
General
Full URL
https://instagramstatic-a.akamaihd.net/h1/webfonts/proximanova-reg-webfont.woff/a9a9773b8e29.woff
Requested by
Host: instagramstatic-a.akamaihd.net
URL: https://instagramstatic-a.akamaihd.net/h1/scripts/webfont.js/c0456c81549b.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:78::5f64:f89b , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8b077b5618f2404f82a34304f4f143b506064d2280e2cd298a4e0d3d281cc0d7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36
Referer
http://instagramsec.com/
Origin
http://instagramsec.com

Response headers

date
Wed, 02 Aug 2017 15:12:02 GMT
content-encoding
gzip
last-modified
Tue, 26 Jan 2016 19:15:08 GMT
server
AmazonS3
x-amz-request-id
A13577D2A6FA9189
etag
"931516a7f1a407bb751eacbb96ae45f5"
vary
Accept-Encoding
content-type
application/x-font-woff
status
200
cache-control
public,max-age=315360000
accept-ranges
bytes
access-control-allow-origin
*
content-length
13229
x-amz-id-2
LkUJVICofcWZy+usaurl18j/4MTssuPalwF6aLYAWEzcBJn5xEOc7WqcT/zQJSF9cLsVdxORxJA=
615c1b06d8fa.woff
instagramstatic-a.akamaihd.net/h1/webfonts/proximanova-sbold-webfont.woff/
13 KB
13 KB
Font
General
Full URL
https://instagramstatic-a.akamaihd.net/h1/webfonts/proximanova-sbold-webfont.woff/615c1b06d8fa.woff
Requested by
Host: instagramstatic-a.akamaihd.net
URL: https://instagramstatic-a.akamaihd.net/h1/scripts/webfont.js/c0456c81549b.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:78::5f64:f89b , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2040cc0ac8ba21e39a71fa2bd4f993c741093b13b0a471f21c1e4c9f27ecd7a2

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36
Referer
http://instagramsec.com/
Origin
http://instagramsec.com

Response headers

date
Wed, 02 Aug 2017 15:12:02 GMT
content-encoding
gzip
last-modified
Tue, 26 Jan 2016 19:15:07 GMT
server
AmazonS3
x-amz-request-id
1AAD125749655453
etag
"ed04dbe6eed046bf97a33ca6bc736f4e"
vary
Accept-Encoding
content-type
application/x-font-woff
status
200
cache-control
public,max-age=315360000
accept-ranges
bytes
access-control-allow-origin
*
content-length
13024
x-amz-id-2
7Q36eDvCvM3mdZgZI/fFcx6ZMOX6ybwjKm5adLR8F04acHKAaQTEnXIKpAojXnH2s5A2maxSEKg=
618250d25a4d.woff
instagramstatic-a.akamaihd.net/h1/webfonts/proximanova-bold-webfont.woff/
13 KB
13 KB
Font
General
Full URL
https://instagramstatic-a.akamaihd.net/h1/webfonts/proximanova-bold-webfont.woff/618250d25a4d.woff
Requested by
Host: instagramstatic-a.akamaihd.net
URL: https://instagramstatic-a.akamaihd.net/h1/scripts/webfont.js/c0456c81549b.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:78::5f64:f89b , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0b5a2e93ff7a7d27e385a61773a01adeb2500ef6eb330dbdee76207c96541a44

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36
Referer
http://instagramsec.com/
Origin
http://instagramsec.com

Response headers

date
Wed, 02 Aug 2017 15:12:02 GMT
content-encoding
gzip
last-modified
Tue, 26 Jan 2016 19:15:08 GMT
server
AmazonS3
x-amz-request-id
14A2AC6BB87A258F
etag
"d9a8c59bb3ff6a4da0fab439494c7028"
vary
Accept-Encoding
content-type
application/x-font-woff
status
200
cache-control
public,max-age=315360000
accept-ranges
bytes
access-control-allow-origin
*
content-length
13144
x-amz-id-2
h9SXWIahNXZk5tCLTR22LszAz3b+1ABTEsQhYq4KwHRN62JmbdZ36ApJtjzz5M0tq99CcvYyJfo=
829d8b.png
instagramstatic-a.akamaihd.net/h1/sprites/whiteout/
68 KB
65 KB
Image
General
Full URL
https://instagramstatic-a.akamaihd.net/h1/sprites/whiteout/829d8b.png
Requested by
Host: instagramsec.com
URL: http://instagramsec.com/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:78::5f64:f872 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3495b19589fb4ce66fb5082e0d89cd58aa15bff84de4551a0a25f4b2bdc12f35

Request headers

Referer
http://instagramsec.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

date
Wed, 02 Aug 2017 15:12:03 GMT
content-encoding
gzip
last-modified
Tue, 10 May 2016 23:37:01 GMT
server
AmazonS3
x-amz-request-id
E5456FCDA43FEA00
etag
"55104428fcfe4879ec74e9f5a18fd6c4"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public,max-age=315360000
accept-ranges
bytes
access-control-allow-origin
*
content-length
66847
x-amz-id-2
dBZbJOEQPbqUwG2clzQv9DQ/Wy3j5kzt83dCg/d88Brj8oWx88y6k6oqvi4EKfqkRLtGf7PdpmI=

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Instagram (Social Network)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Domain/Path Name / Value
instagramsec.com/ Name: ig_vw
Value: 1600
instagramsec.com/ Name: ig_pr
Value: 1