![](/screenshots/90f71f54-44d8-45f5-885b-9c44584b46f3.png)
www.filesusr.com
Open in
urlscan Pro
2600:9000:2490:e200:0:7dcd:9780:93a1
Malicious Activity!
Public Scan
Effective URL: https://www.filesusr.com/html/ca29a3_bf6671138bd57af9b3b1ede7eb701f0e.html?987217*bWF0YXRyb2xlczUwMDBAZ21haWwuY29t*https:...
Submission: On May 18 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on December 25th 2023. Valid for: 6 months.
This is the only time www.filesusr.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Instagram (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2606:4700:10:... 2606:4700:10::6814:8a41 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 1 | 172.67.1.225 172.67.1.225 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2600:9000:249... 2600:9000:2490:e200:0:7dcd:9780:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 2a00:1450:400... 2a00:1450:4001:80f::2009 | 15169 (GOOGLE) (GOOGLE) | |
8 | 2a03:2880:f27... 2a03:2880:f276:1e9:face:b00c:0:4420 | 32934 (FACEBOOK) (FACEBOOK) | |
1 | 2a00:1450:400... 2a00:1450:4001:80b::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 172.67.191.13 172.67.191.13 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
14 | 6 |
ASN32934 (FACEBOOK, US)
www.instagram.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
instagram.com
www.instagram.com — Cisco Umbrella Rank: 1895 |
815 KB |
2 |
blogger.com
www.blogger.com — Cisco Umbrella Rank: 11861 |
15 KB |
2 |
tinyurl.com
2 redirects
www.tinyurl.com — Cisco Umbrella Rank: 263447 tinyurl.com — Cisco Umbrella Rank: 17151 |
1 KB |
1 |
exploits-fr.com
exploits-fr.com |
4 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 380 |
34 KB |
1 |
filesusr.com
www.filesusr.com |
4 MB |
0 |
unpkg.com
Failed
unpkg.com Failed |
|
14 | 7 |
Domain | Requested by | |
---|---|---|
8 | www.instagram.com |
www.filesusr.com
|
2 | www.blogger.com |
www.filesusr.com
|
1 | exploits-fr.com | |
1 | ajax.googleapis.com |
www.filesusr.com
|
1 | www.filesusr.com | |
1 | tinyurl.com | 1 redirects |
1 | www.tinyurl.com | 1 redirects |
0 | unpkg.com Failed |
www.filesusr.com
|
14 | 8 |
This site contains links to these domains. Also see Links.
Domain |
---|
about.facebook.com |
about.instagram.com |
help.instagram.com |
developers.facebook.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.filesusr.com Sectigo RSA Domain Validation Secure Server CA |
2023-12-25 - 2024-06-22 |
6 months | crt.sh |
*.blogger.com WR2 |
2024-05-06 - 2024-07-29 |
3 months | crt.sh |
*.www.instagram.com DigiCert SHA2 High Assurance Server CA |
2024-02-25 - 2024-05-25 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-05-06 - 2024-07-29 |
3 months | crt.sh |
exploits-fr.com Cloudflare Inc ECC CA-3 |
2024-02-08 - 2024-12-31 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.filesusr.com/html/ca29a3_bf6671138bd57af9b3b1ede7eb701f0e.html?987217*bWF0YXRyb2xlczUwMDBAZ21haWwuY29t*https://www.surveymonkey.com/r/SYRY2RS**Instagram
Frame ID: E7ED6D79B42DEBA1D56A9EEE0F309B0C
Requests: 14 HTTP requests in this frame
Screenshot
![](/screenshots/90f71f54-44d8-45f5-885b-9c44584b46f3.png)
Page Title
InstagramPage URL History Show full URLs
-
http://www.tinyurl.com/4nh3stx7/
HTTP 307
https://www.tinyurl.com/4nh3stx7/ HTTP 301
http://tinyurl.com/4nh3stx7/ HTTP 307
https://tinyurl.com/4nh3stx7/ HTTP 301
https://www.filesusr.com/html/ca29a3_bf6671138bd57af9b3b1ede7eb701f0e.html?987217*bWF0YXRyb2xlczUwMDB... Page URL
Detected technologies
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
Title: Meta
Search URL Search Domain Scan URL
Title: Información
Search URL Search Domain Scan URL
Title: Blog
Search URL Search Domain Scan URL
Title: Ayuda
Search URL Search Domain Scan URL
Title: API
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://www.tinyurl.com/4nh3stx7/
HTTP 307
https://www.tinyurl.com/4nh3stx7/ HTTP 301
http://tinyurl.com/4nh3stx7/ HTTP 307
https://tinyurl.com/4nh3stx7/ HTTP 301
https://www.filesusr.com/html/ca29a3_bf6671138bd57af9b3b1ede7eb701f0e.html?987217*bWF0YXRyb2xlczUwMDBAZ21haWwuY29t*https://www.surveymonkey.com/r/SYRY2RS**Instagram Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
ca29a3_bf6671138bd57af9b3b1ede7eb701f0e.html
www.filesusr.com/html/ Redirect Chain
|
4 MB 4 MB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
55013136-widget_css_bundle.css
www.blogger.com/static/v1/widgets/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1938605287-css_bundle_v2.css
www.blogger.com/static/v1/widgets/ |
36 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
vue@next
unpkg.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fdfe239b7c9f.png
www.instagram.com/static/images/homepage/screenshots/screenshot1.png/ |
182 KB 182 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4d62acb667fb.png
www.instagram.com/static/images/homepage/screenshots/screenshot2.png/ |
55 KB 55 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
94edb770accf.png
www.instagram.com/static/images/homepage/screenshots/screenshot3.png/ |
148 KB 148 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
a4fd825e3d49.png
www.instagram.com/static/images/homepage/screenshots/screenshot4.png/ |
231 KB 232 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
e2247c4f90de.png
www.instagram.com/static/images/appstore-install-badges/badge_ios_spanish_latinamerica_mexico.png/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3cd8a27083c0.png
www.instagram.com/static/images/appstore-install-badges/badge_android_spanish_latinamerica_mexico-es_LA.png/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.12.4/ |
95 KB 34 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1dc085cdb87d.png
www.instagram.com/static/images/homepage/phones/home-phones.png/ |
109 KB 109 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
32f0a4f27407.png
www.instagram.com/static/bundles/es6/sprite_core_32f0a4f27407.png/ |
75 KB 75 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon-ig.ico
exploits-fr.com/blogger/assets/images/ |
5 KB 4 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- unpkg.com
- URL
- https://unpkg.com/vue@next
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Instagram (Social Network)26 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| regexS object| regex string| tmpURL object| results object| llegaron object| uno undefined| dos undefined| tres undefined| cuatro undefined| cinco undefined| conten object| myString object| myArray undefined| separame undefined| separado undefined| llavesecreta string| urlfin undefined| idfb string| regreso string| detector undefined| lang string| enblanco string| email string| ip function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.tinyurl.com/ | Name: __cf_bm Value: dlhCm12h6D79PTfzkgmwlbIP05_IKe3xHAKIde3VdhM-1715994372-1.0.1.1-MedHSYc4hFvFKWZ2qmEXha9gRgumsRaksl_vcfFM96Sh8GdocsNjrXTzwZLZ7cWdwWNt_KjIEgby.5KTuC0S6g |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
exploits-fr.com
tinyurl.com
unpkg.com
www.blogger.com
www.filesusr.com
www.instagram.com
www.tinyurl.com
unpkg.com
172.67.1.225
172.67.191.13
2600:9000:2490:e200:0:7dcd:9780:93a1
2606:4700:10::6814:8a41
2a00:1450:4001:80b::200a
2a00:1450:4001:80f::2009
2a03:2880:f276:1e9:face:b00c:0:4420
0d3b03b6b3a5d8d93f2e8e420352906459a9df4a19a34accac281e7ef1d07856
12f4c816adc97f7808a7746329451a4b3fbbc8e8a67bd1337984e6ab6079c6a1
1a2eca9e492e3a21e02dd77ad44d7af45c4091d35ede79e948b7a3f23e5b3617
272a0e710126ac27b2e914a8ae44c5e02105eca853cfa87467883ab432d7cd5e
29c503acf8430c22bf525a0c518600573c885c64e2098f34a04e8788fffceb6e
3bac9eb2e86c3617651a5e20ad8204c867f7625fb7142affaa85ec5ff2671c7b
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
765601709b703cd426bea3c604efc4a3efcf22e886eb8b78f4521b5d5f8d0482
7b9eea4b38cd8ef980f06f77a5d24ca0c2da44e1970f5696c892f8f47fb16526
8afbe7fe66756b949187ba3af1dbe6ffaece09aad07a3162b76334836db87637
93bde1855cd2f2ce93ae1e63bdb4cc531dc74d98bfb85803cc8d3aaf7e193d3a
9a70a7b2974cd3af3bfb572fe5a4b01bb93e25fe3dd0a4cd6a411912508050c3
9ff801298d1af2640890052e2ff88045f3f9740c268bc969c5bc02bbac5ec862