![](/screenshots/d10cd5ed-6316-49e3-a749-682492a2f924.png)
lnstagram-partner-business.ga
Open in
urlscan Pro
2606:4700:3034::681f:51ba
Malicious Activity!
Public Scan
Submission: On December 18 via manual from US
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 3rd 2020. Valid for: a year.
This is the only time lnstagram-partner-business.ga was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Instagram (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2606:4700:303... 2606:4700:3034::681f:51ba | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:81f::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 145.239.131.60 145.239.131.60 | 16276 (OVH) (OVH) | |
1 | 2406:da00:ff0... 2406:da00:ff00::3400:d490 | 14618 (AMAZON-AES) (AMAZON-AES) | |
7 | 5 |
ASN13335 (CLOUDFLARENET, US)
lnstagram-partner-business.ga |
Apex Domain Subdomains |
Transfer | |
---|---|---|
1 |
instagram.com
instagram.com |
128 KB |
1 |
ibb.co
image.ibb.co |
3 KB |
1 |
googleapis.com
ajax.googleapis.com |
30 KB |
1 |
lnstagram-partner-business.ga
lnstagram-partner-business.ga |
40 KB |
0 |
newbigdata.science
Failed
newbigdata.science Failed |
|
7 | 5 |
Domain | Requested by | |
---|---|---|
1 | instagram.com |
instagram.com
|
1 | image.ibb.co |
lnstagram-partner-business.ga
|
1 | ajax.googleapis.com |
lnstagram-partner-business.ga
|
1 | lnstagram-partner-business.ga | |
0 | newbigdata.science Failed |
lnstagram-partner-business.ga
|
7 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-08-03 - 2021-08-03 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-11-10 - 2021-02-02 |
3 months | crt.sh |
ibb.co R3 |
2020-12-03 - 2021-03-03 |
3 months | crt.sh |
*.instagram.com DigiCert SHA2 High Assurance Server CA |
2020-10-22 - 2021-01-19 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://lnstagram-partner-business.ga/
Frame ID: 618883C7CBE8D1ABD63B16A36D123BCE
Requests: 5 HTTP requests in this frame
Frame:
https://newbigdata.science/connect/xd_arbiter/r/qMnGlIs-JNW.js?version=42&__cpo=aHR0cHM6Ly9zdGF0aWN4eC5mYWNlYm9vay5jb20
Frame ID: E1DDA6881B039D199E1750A9B18429BA
Requests: 1 HTTP requests in this frame
Frame:
https://newbigdata.science/connect/ping?client_id=124024574287414&domain=www.instagram.com&origin=1&redirect_uri=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2FqMnGlIs-JNW.js%3Fversion%3D42%23cb%3Df1f19c0950ec264%26domain%3Dwww.instagram.com%26origin%3Dhttps%253A%252F%252Fwww.instagram.com%252Ff59a022dfc20ec%26relation%3Dparent&response_type=token%2Csigned_request%2Ccode&sdk=joey&version=v2.2&__cpo=aHR0cHM6Ly93d3cuZmFjZWJvb2suY29t
Frame ID: C24026DCABED72FD6614430C8E86AEE6
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/d10cd5ed-6316-49e3-a749-682492a2f924.png)
Detected technologies
Detected patterns
- headers server /^cloudflare$/i
Detected patterns
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
lnstagram-partner-business.ga/ |
175 KB 40 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
__cpa.cp.js
newbigdata.science/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
image.ibb.co/fjkP4z/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
qMnGlIs-JNW.js
newbigdata.science/connect/xd_arbiter/r/ Frame E1DD |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
ping
newbigdata.science/connect/ Frame C240 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2115b50d229d.png
instagram.com/static/bundles/base/sprite_core.png/ |
128 KB 128 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- newbigdata.science
- URL
- https://newbigdata.science/__cpa.cp.js?dummy=bb38f5627f85538afdae92980142c88c&__cpo=1
- Domain
- newbigdata.science
- URL
- https://newbigdata.science/connect/xd_arbiter/r/qMnGlIs-JNW.js?version=42&__cpo=aHR0cHM6Ly9zdGF0aWN4eC5mYWNlYm9vay5jb20
- Domain
- newbigdata.science
- URL
- https://newbigdata.science/connect/ping?client_id=124024574287414&domain=www.instagram.com&origin=1&redirect_uri=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2FqMnGlIs-JNW.js%3Fversion%3D42%23cb%3Df1f19c0950ec264%26domain%3Dwww.instagram.com%26origin%3Dhttps%253A%252F%252Fwww.instagram.com%252Ff59a022dfc20ec%26relation%3Dparent&response_type=token%2Csigned_request%2Ccode&sdk=joey&version=v2.2&__cpo=aHR0cHM6Ly93d3cuZmFjZWJvb2suY29t
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Instagram (Social Network)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.lnstagram-partner-business.ga/ | Name: __cfduid Value: d5770bd3178b462a8b31a6322c15eaa561608302588 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
image.ibb.co
instagram.com
lnstagram-partner-business.ga
newbigdata.science
newbigdata.science
145.239.131.60
2406:da00:ff00::3400:d490
2606:4700:3034::681f:51ba
2a00:1450:4001:81f::200a
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
405e90473f7ac27061af0027ea856fe80c6f71310edb768f23f774c4088eb8c8
6272b28532162ed0cb4f409a2a6db4c9282f497cbe71a3a55b7b7098f79ca368
8d462c8f2d10700b31c8263fca0da5b11f0921a99eb15c1c3cebc1e37889b1cc