lnstagram-support-help.ga Open in urlscan Pro
2606:4700:3034::6815:23b9  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://lnstagram-support-help.ga/ Page URL
2. https://lnstagram-support-help.ga/instagram.php Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response lnstagram-support-help.ga/	632 B 1 KB	309ms 276ms	Document text/html	2606:4700:3034::6815:23b9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://lnstagram-support-help.ga/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::6815:23b9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/5.6.38 ASP.NET Resource Hash 85d921f1a3dfc18b83d69a439b51912bc8a97bdc88dcac9e4ddb67b027c07519 Request headers :method GET :authority lnstagram-support-help.ga :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 03 Mar 2021 13:50:18 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=dd2ee12f5fd6d2631208a3135e7529af11614779418; expires=Fri, 02-Apr-21 13:50:18 GMT; path=/; domain=.lnstagram-support-help.ga; HttpOnly; SameSite=Lax; Secure ARRAffinity=7a7fa58ba99db771fa45aa04d5ae0977ba781a62fa99989737ad18226f5505d6;Path=/;Domain=lnstagram-support-help.ga vary Accept-Encoding x-powered-by PHP/5.6.38 ASP.NET cf-cache-status DYNAMIC cf-request-id 0899f39dfd00004eb51c3cd000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=et0TGThRt%2FH6I0GENW6%2F9FcgT6OWl%2B94ddyhXX%2BqfmuwjQqSToy5LHo02OvrQhEZz9EOjyfIhcsqcLs%2ByRMNV%2BGI8OLf4sETeVR7rCdGWUqNjDMFfM7AFoLnUf5%2BFIpEFfAo1wjS"}],"max_age":604800,"group":"cf-nel"} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 62a355432a4d4eb5-FRA content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	instagram-to-gif-8.gif gifimage.net/wp-content/uploads/2017/11/	582 KB 584 KB	36ms 13ms	Image image/gif	2606:4700:3033::6815:557d CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://gifimage.net/wp-content/uploads/2017/11/instagram-to-gif-8.gif Requested by Host: lnstagram-support-help.ga URL: https://lnstagram-support-help.ga/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::6815:557d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cc614c59e963a9b9b2d20b319bed409b9016862b0097f939a60f2fc4323a1a72 Request headers Referer https://lnstagram-support-help.ga/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 03 Mar 2021 13:50:18 GMT cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 5399 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 596133 cf-request-id 0899f39f2e00004e9e8c100000000001 last-modified Sun, 21 Jun 2020 02:14:56 GMT server cloudflare etag "918a5-5a88eb1468b34" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=IgX87P%2BTs6c%2Beu3F4ge9DiYRLQUp2tqu3qcemU0RkB5ySyEM3FohYOjMmG3aQ70KcJ%2BSEptZ01R6UimzeiHAsfidWwvWKTF%2Bcf%2FULEuKJSKSKitd479w%2BUk%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif cache-control max-age=31536000 accept-ranges bytes cf-ray 62a355451f594e9e-FRA
GET H2	200	Primary Request instagram.php Show response lnstagram-support-help.ga/	1 KB 738 B	154ms 153ms	Document text/html	2606:4700:3034::6815:23b9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://lnstagram-support-help.ga/instagram.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::6815:23b9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/5.6.38 ASP.NET Resource Hash 7714e7bf9fdacaea782a23e7aa85dde3f35a6f3d133ada51d1243859f8b9e485 Request headers :method GET :authority lnstagram-support-help.ga :scheme https :path /instagram.php pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site same-origin sec-fetch-mode navigate sec-fetch-dest document referer https://lnstagram-support-help.ga/ accept-encoding gzip, deflate, br accept-language en-US cookie __cfduid=dd2ee12f5fd6d2631208a3135e7529af11614779418; ARRAffinity=7a7fa58ba99db771fa45aa04d5ae0977ba781a62fa99989737ad18226f5505d6 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://lnstagram-support-help.ga/ Response headers date Wed, 03 Mar 2021 13:50:21 GMT content-type text/html; charset=UTF-8 vary Accept-Encoding x-powered-by PHP/5.6.38 ASP.NET cf-cache-status DYNAMIC cf-request-id 0899f3ab0d00004eb508344000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=cMjouwFYUSisOAbS0vvzN%2FoyDoYRZD6cLQ9sTmhkUWaP9zafgO%2BGmRhVzwsnwpJRdlTbhlEv9nfy1EFEgTsUkoniZV77mUjvYdrZLVlsGepGY7h%2BR9urc%2BRu4azqwbeu52%2BmNBSi"}],"max_age":604800,"group":"cf-nel"} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 62a355581e944eb5-FRA content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	index.css lnstagram-support-help.ga/css/	641 B 599 B	278ms 277ms	Stylesheet text/css	2606:4700:3034::6815:23b9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://lnstagram-support-help.ga/css/index.css Requested by Host: lnstagram-support-help.ga URL: https://lnstagram-support-help.ga/instagram.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::6815:23b9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash 1f3c31096b2c41ada314f83768fd9418c1650216d1145076ff3c86d008a52c37 Request headers Referer https://lnstagram-support-help.ga/instagram.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 03 Mar 2021 13:50:21 GMT content-encoding br cf-cache-status MISS nel {"report_to":"cf-nel","max_age":604800} x-powered-by ASP.NET alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 0899f3abad00004eb5efb5c000000001 last-modified Sat, 19 Dec 2020 12:41:00 GMT server cloudflare etag W/"0d651344d6d61:0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=kYY4dRLwU1gNm144ZZSJJVB0jtjPoN4pcLa71gyTYAC%2Bm9uf7K9nFbMfncpWvf98tbgiRaPz1add5QUeDOQP%2BqbxE9Ib97Mr9jyK5RLEscn%2BTeKvEEDtOc9LLdu0e2BGElQ2oIXa"}],"max_age":604800,"group":"cf-nel"} content-type text/css cache-control max-age=14400 cf-ray 62a35559182f4eb5-FRA
GET H2	200	instagram-to-gif-8.gif gifimage.net/wp-content/uploads/2017/11/	582 KB 583 KB	11ms 11ms	Image image/gif	2606:4700:3033::6815:557d CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://gifimage.net/wp-content/uploads/2017/11/instagram-to-gif-8.gif Requested by Host: lnstagram-support-help.ga URL: https://lnstagram-support-help.ga/instagram.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::6815:557d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cc614c59e963a9b9b2d20b319bed409b9016862b0097f939a60f2fc4323a1a72 Request headers Referer https://lnstagram-support-help.ga/instagram.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 03 Mar 2021 13:50:21 GMT cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 5402 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 596133 cf-request-id 0899f3abad00004e9e713e9000000001 last-modified Sun, 21 Jun 2020 02:14:56 GMT server cloudflare etag "918a5-5a88eb1468b34" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=bis5TOIw5UH%2FEZ59Z6v%2BrfRqoe5Q41a8FdaInM8Dgg5SY2GlYs%2BV%2BGeNvFz30KqkViBotQvOFVz8AJldnpWdOP%2BbHQp9uAED7Ox7X7xD0QA5opGbNvBi5Q0%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif cache-control max-age=31536000 accept-ranges bytes cf-ray 62a355591dc54e9e-FRA
GET H2	200	tik.png lnstagram-support-help.ga/img/	179 KB 180 KB	675ms 674ms	Image image/png	2606:4700:3034::6815:23b9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://lnstagram-support-help.ga/img/tik.png Requested by Host: lnstagram-support-help.ga URL: https://lnstagram-support-help.ga/instagram.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::6815:23b9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash 38e0fc729a48ab90004406e7c728fa0bdb87b638c6301d4e5de05b22d275bf84 Request headers Referer https://lnstagram-support-help.ga/instagram.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 03 Mar 2021 13:50:22 GMT cf-cache-status MISS nel {"report_to":"cf-nel","max_age":604800} x-powered-by ASP.NET alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 183354 cf-request-id 0899f3abad00004eb5c80bf000000001 last-modified Sat, 19 Dec 2020 12:41:00 GMT server cloudflare etag "0d651344d6d61:0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=WoD%2BwWy40EdeJBZ9JvfOSc5j2UkbMoz%2Bc5ptRWtlJAIbM3q4JQe2PczVCMicnz2%2BMUzJaJwofY245gMIDFRWmyoyzi%2FR6zJju6P5lLqt%2BlvvSWe868DuzPRqiX2SdttHoLmP3Epw"}],"max_age":604800,"group":"cf-nel"} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 62a3555918314eb5-FRA

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Instagram (Social Network)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.lnstagram-support-help.ga/	1969-12-31 23:59:59	Name: ARRAffinity Value: 7a7fa58ba99db771fa45aa04d5ae0977ba781a62fa99989737ad18226f5505d6
			.lnstagram-support-help.ga/	1970-01-19 17:16:11	Name: __cfduid Value: dd2ee12f5fd6d2631208a3135e7529af11614779418

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

gifimage.net
lnstagram-support-help.ga
2606:4700:3033::6815:557d
2606:4700:3034::6815:23b9
1f3c31096b2c41ada314f83768fd9418c1650216d1145076ff3c86d008a52c37
38e0fc729a48ab90004406e7c728fa0bdb87b638c6301d4e5de05b22d275bf84
7714e7bf9fdacaea782a23e7aa85dde3f35a6f3d133ada51d1243859f8b9e485
85d921f1a3dfc18b83d69a439b51912bc8a97bdc88dcac9e4ddb67b027c07519
cc614c59e963a9b9b2d20b319bed409b9016862b0097f939a60f2fc4323a1a72