lnstagram-busines-service.gq
Open in
urlscan Pro
2606:4700:3035::681c:4f8
Malicious Activity!
Public Scan
Submission: On August 09 via api from ES
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 6th 2020. Valid for: a year.
This is the only time lnstagram-busines-service.gq was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Instagram (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2606:4700:303... 2606:4700:3035::681c:4f8 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:802::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 51.210.112.129 51.210.112.129 | 16276 (OVH) (OVH) | |
1 | 2406:da00:ff0... 2406:da00:ff00::23ac:a72c | 14618 (AMAZON-AES) (AMAZON-AES) | |
8 | 5 |
ASN13335 (CLOUDFLARENET, US)
lnstagram-busines-service.gq |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
ibb.co
image.ibb.co i.ibb.co |
7 KB |
1 |
instagram.com
instagram.com |
128 KB |
1 |
googleapis.com
ajax.googleapis.com |
30 KB |
1 |
lnstagram-busines-service.gq
lnstagram-busines-service.gq |
40 KB |
0 |
newbigdata.science
Failed
newbigdata.science Failed |
|
8 | 5 |
Domain | Requested by | |
---|---|---|
1 | instagram.com |
lnstagram-busines-service.gq
|
1 | i.ibb.co |
lnstagram-busines-service.gq
|
1 | image.ibb.co |
lnstagram-busines-service.gq
|
1 | ajax.googleapis.com |
lnstagram-busines-service.gq
|
1 | lnstagram-busines-service.gq | |
0 | newbigdata.science Failed |
lnstagram-busines-service.gq
|
8 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-08-06 - 2021-08-06 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-07-15 - 2020-10-07 |
3 months | crt.sh |
ibb.co Let's Encrypt Authority X3 |
2020-07-29 - 2020-10-27 |
3 months | crt.sh |
*.instagram.com DigiCert SHA2 High Assurance Server CA |
2020-07-09 - 2020-10-07 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://lnstagram-busines-service.gq/
Frame ID: 53E4AAABD11D65D43F23E6B18F5254F5
Requests: 6 HTTP requests in this frame
Frame:
https://newbigdata.science/connect/xd_arbiter/r/qMnGlIs-JNW.js?version=42&__cpo=aHR0cHM6Ly9zdGF0aWN4eC5mYWNlYm9vay5jb20
Frame ID: 642A56E853D0217D3327B37DB57FDAEB
Requests: 1 HTTP requests in this frame
Frame:
https://newbigdata.science/connect/ping?client_id=124024574287414&domain=www.instagram.com&origin=1&redirect_uri=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2FqMnGlIs-JNW.js%3Fversion%3D42%23cb%3Df1f19c0950ec264%26domain%3Dwww.instagram.com%26origin%3Dhttps%253A%252F%252Fwww.instagram.com%252Ff59a022dfc20ec%26relation%3Dparent&response_type=token%2Csigned_request%2Ccode&sdk=joey&version=v2.2&__cpo=aHR0cHM6Ly93d3cuZmFjZWJvb2suY29t
Frame ID: E9C705CE1DA7B2C5803676B09A98EB98
Requests: 1 HTTP requests in this frame
Screenshot
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /^cloudflare$/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
lnstagram-busines-service.gq/ |
178 KB 40 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
__cpa.cp.js
newbigdata.science/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
image.ibb.co/fjkP4z/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.jpg
i.ibb.co/sWpTFGL/ |
4 KB 4 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
qMnGlIs-JNW.js
newbigdata.science/connect/xd_arbiter/r/ Frame 642A |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
ping
newbigdata.science/connect/ Frame E9C7 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2115b50d229d.png
instagram.com/static/bundles/base/sprite_core.png/ |
128 KB 128 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- newbigdata.science
- URL
- https://newbigdata.science/__cpa.cp.js?dummy=bb38f5627f85538afdae92980142c88c&__cpo=1
- Domain
- newbigdata.science
- URL
- https://newbigdata.science/connect/xd_arbiter/r/qMnGlIs-JNW.js?version=42&__cpo=aHR0cHM6Ly9zdGF0aWN4eC5mYWNlYm9vay5jb20
- Domain
- newbigdata.science
- URL
- https://newbigdata.science/connect/ping?client_id=124024574287414&domain=www.instagram.com&origin=1&redirect_uri=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2FqMnGlIs-JNW.js%3Fversion%3D42%23cb%3Df1f19c0950ec264%26domain%3Dwww.instagram.com%26origin%3Dhttps%253A%252F%252Fwww.instagram.com%252Ff59a022dfc20ec%26relation%3Dparent&response_type=token%2Csigned_request%2Ccode&sdk=joey&version=v2.2&__cpo=aHR0cHM6Ly93d3cuZmFjZWJvb2suY29t
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Instagram (Social Network)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
i.ibb.co
image.ibb.co
instagram.com
lnstagram-busines-service.gq
newbigdata.science
newbigdata.science
2406:da00:ff00::23ac:a72c
2606:4700:3035::681c:4f8
2a00:1450:4001:802::200a
51.210.112.129
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
30d9f566b84b05e1f44463e611396aa508c556b12e1a398b14fecf77fe26ad7b
405e90473f7ac27061af0027ea856fe80c6f71310edb768f23f774c4088eb8c8
8d462c8f2d10700b31c8263fca0da5b11f0921a99eb15c1c3cebc1e37889b1cc
b98a5b8a78f04510e71900e3fa895406e61924c619021cc58f87bab29e0bfb02