verification-lnstagram.ml Open in urlscan Pro
66.85.73.153 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://verification-lnstagram.ml/
Submission: On July 26 via automatic, source certstream-suspicious (July 26th 2020, 8:57:30 pm UTC)

Summary HTTP 16 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 5 domains to perform 16 HTTP transactions. The main IP is 66.85.73.153, located in Kansas City, United States and belongs to JOESDATACENTER, US. The main domain is verification-lnstagram.ml.
TLS certificate: Issued by Let's Encrypt Authority X3 on July 26th 2020. Valid for: 3 months.

This is the only time verification-lnstagram.ml was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Instagram (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
10	66.85.73.153 66.85.73.153	19969 (JOESDATAC...) (JOESDATACENTER)
1 2	2606:4700:303... 2606:4700:3038::681f:ea1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
16	5

10 66.85.73.153 (Kansas City, United States)

ASN19969 (JOESDATACENTER, US)

verification-lnstagram.ml	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3038::681f:ea1 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

i.hizliresim.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	verification-lnstagram.ml verification-lnstagram.ml	119 KB
2	facebook.com www.facebook.com	636 B
2	facebook.net connect.facebook.net	167 KB
2	hizliresim.com 1 redirects i.hizliresim.com	138 KB
0	somee.com Failed ads.mgmt.somee.com Failed
16	5

	Domain	Requested by
10	verification-lnstagram.ml	verification-lnstagram.ml
2	www.facebook.com	verification-lnstagram.ml
2	connect.facebook.net	verification-lnstagram.ml connect.facebook.net
2	i.hizliresim.com	1 redirects verification-lnstagram.ml
0	ads.mgmt.somee.com Failed	verification-lnstagram.ml
16	5

This site contains links to these domains. Also see Links.

Domain
somee.com

Subject Issuer	Validity	Valid
*.verification-lnstagram.ml Let's Encrypt Authority X3	`2020-07-26` - `2020-10-24`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-07-24` - `2021-07-24`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-07-21` - `2020-10-12`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://verification-lnstagram.ml/
Frame ID: FEFFBEC3DDDE53E603C9C8BAA2070DC1
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Windows Server (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

IIS (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

Page Statistics

16
Requests

94 %
HTTPS

75 %
IPv6

5
Domains

5
Subdomains

5
IPs

2
Countries

424 kB
Transfer

912 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://somee.com/
Title: Web hosting by Somee.com

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

http://i.hizliresim.com/1JbgnY.png HTTP 301
https://i.hizliresim.com/1JbgnY.png

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
verification-lnstagram.ml/ 104 KB
104 KB 792ms
272ms Document
text/html 66.85.73.153
JOESDATACENTER

General

Check archive.org

Show headers Download Go to

Full URL: https://verification-lnstagram.ml/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 66.85.73.153 Kansas City, United States, ASN19969 (JOESDATACENTER, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / PHP/5.4.24 ASP.NET
Resource Hash: 7d74a5d9f1403228d81025bbf28283af57a348ebb548af3962b75b2d3325e6a2

Request headers

Host: verification-lnstagram.ml
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: text/html
Server: Microsoft-IIS/8.5
X-Powered-By: PHP/5.4.24 ASP.NET
Date: Sun, 26 Jul 2020 20:57:11 GMT
Content-Length: 106131

GET
H/1.1 404
Not Found 1425767024389221
verification-lnstagram.ml/login_files/ 0
0 400ms
134ms Script
text/html 66.85.73.153
JOESDATACENTER

General

Check archive.org

Show headers Download Go to

Full URL: https://verification-lnstagram.ml/login_files/1425767024389221
Requested by: Host: verification-lnstagram.ml
URL: https://verification-lnstagram.ml/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 66.85.73.153 Kansas City, United States, ASN19969 (JOESDATACENTER, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash

Request headers

Referer: https://verification-lnstagram.ml/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 26 Jul 2020 20:57:11 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Content-Length: 1245
Content-Type: text/html

GET
H/1.1 404
Not Found fbevents.js.indir
verification-lnstagram.ml/login_files/ 0
0 406ms
137ms Script
text/html 66.85.73.153
JOESDATACENTER

General

Check archive.org

Show headers Download Go to

Full URL: https://verification-lnstagram.ml/login_files/fbevents.js.indir
Requested by: Host: verification-lnstagram.ml
URL: https://verification-lnstagram.ml/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 66.85.73.153 Kansas City, United States, ASN19969 (JOESDATACENTER, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash

Request headers

Referer: https://verification-lnstagram.ml/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 26 Jul 2020 20:57:11 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Content-Length: 1245
Content-Type: text/html

GET
H/1.1 404
Not Found 1425767024389221(1)
verification-lnstagram.ml/login_files/ 0
0 295ms
135ms Script
text/html 66.85.73.153
JOESDATACENTER

General

Check archive.org

Show headers Download Go to

Full URL: https://verification-lnstagram.ml/login_files/1425767024389221(1)
Requested by: Host: verification-lnstagram.ml
URL: https://verification-lnstagram.ml/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 66.85.73.153 Kansas City, United States, ASN19969 (JOESDATACENTER, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash

Request headers

Referer: https://verification-lnstagram.ml/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 26 Jul 2020 20:57:11 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Content-Length: 1245
Content-Type: text/html

GET
H/1.1 404
Not Found fbevents.js(1).indir
verification-lnstagram.ml/login_files/ 0
0 267ms
135ms Script
text/html 66.85.73.153
JOESDATACENTER

General

Check archive.org

Show headers Download Go to

Full URL: https://verification-lnstagram.ml/login_files/fbevents.js(1).indir
Requested by: Host: verification-lnstagram.ml
URL: https://verification-lnstagram.ml/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 66.85.73.153 Kansas City, United States, ASN19969 (JOESDATACENTER, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash

Request headers

Referer: https://verification-lnstagram.ml/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 26 Jul 2020 20:57:11 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Content-Length: 1245
Content-Type: text/html

GET
H2

200

1JbgnY.png
i.hizliresim.com/
Redirect Chain

http://i.hizliresim.com/1JbgnY.png
https://i.hizliresim.com/1JbgnY.png

137 KB
138 KB

535ms
520ms

Image
image/png

2606:4700:3038::681f:ea1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.hizliresim.com/1JbgnY.png
Requested by: Host: verification-lnstagram.ml
URL: https://verification-lnstagram.ml/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::681f:ea1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2aff03379d242be0fd8afca5522a5060bd7c330a11e4fb5a53a4724994036927

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 26 Jul 2020 20:57:13 GMT
cf-cache-status: MISS
x-amz-request-id: 5603F7C5576E87D0
status: 200
x-amz-id-2: MTxWdHD7CSTPM7/C9vu74R66rJ1LAPqpVRf4lNYa3rgu+simpjoYUtW5/77Bgof56nh0+OsJeZR/
last-modified: Thu, 06 Sep 2018 07:19:05 GMT
server: cloudflare
etag: W/"e95a519f19189a32cbd92c50e6575d82"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=604800
cf-request-id: 042e8367f50000634dd7877200000001
cf-ray: 5b91081fec6f634d-FRA
expires: Sun, 02 Aug 2020 20:57:13 GMT

Redirect headers

Date: Sun, 26 Jul 2020 20:57:12 GMT
Server: cloudflare
Vary: Accept-Encoding
Location: https://i.hizliresim.com/1JbgnY.png
Cache-Control: max-age=3600
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 5b91081f8c246479-FRA
cf-request-id: 042e8367b900006479699c8200000001
Expires: Sun, 26 Jul 2020 21:57:12 GMT

GET
H/1.1 200
OK vpaQNA.png
verification-lnstagram.ml/login_files/ 15 KB
15 KB 324ms
253ms Image
image/png 66.85.73.153
JOESDATACENTER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://verification-lnstagram.ml/login_files/vpaQNA.png
Requested by: Host: verification-lnstagram.ml
URL: https://verification-lnstagram.ml/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 66.85.73.153 Kansas City, United States, ASN19969 (JOESDATACENTER, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 9de8c2729ae5603e5a54ebdf8bb76187a8c30d6100b3855853c58eef222f1473

Request headers

Referer: https://verification-lnstagram.ml/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 26 Jul 2020 20:57:11 GMT
Last-Modified: Sun, 26 Jul 2020 20:11:02 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
ETag: "33da74e28863d61:0"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 14967

GET
H/1.1 404
Not Found 6514c5e08593.js.indir
verification-lnstagram.ml/login_files/ 0
0 156ms
154ms Script
text/html 66.85.73.153
JOESDATACENTER

General

Check archive.org

Show headers Download Go to

Full URL: https://verification-lnstagram.ml/login_files/6514c5e08593.js.indir
Requested by: Host: verification-lnstagram.ml
URL: https://verification-lnstagram.ml/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 66.85.73.153 Kansas City, United States, ASN19969 (JOESDATACENTER, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash

Request headers

Referer: https://verification-lnstagram.ml/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 26 Jul 2020 20:57:11 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Content-Length: 1245
Content-Type: text/html

GET
H/1.1 404
Not Found fc3c22cf2d67.js.indir
verification-lnstagram.ml/login_files/ 0
0 264ms
136ms Script
text/html 66.85.73.153
JOESDATACENTER

General

Check archive.org

Show headers Download Go to

Full URL: https://verification-lnstagram.ml/login_files/fc3c22cf2d67.js.indir
Requested by: Host: verification-lnstagram.ml
URL: https://verification-lnstagram.ml/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 66.85.73.153 Kansas City, United States, ASN19969 (JOESDATACENTER, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash

Request headers

Referer: https://verification-lnstagram.ml/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 26 Jul 2020 20:57:11 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Content-Length: 1245
Content-Type: text/html

GET
H/1.1 404
Not Found f1abf980aaf5.js.indir
verification-lnstagram.ml/login_files/ 0
0 292ms
135ms Script
text/html 66.85.73.153
JOESDATACENTER

General

Check archive.org

Show headers Download Go to

Full URL: https://verification-lnstagram.ml/login_files/f1abf980aaf5.js.indir
Requested by: Host: verification-lnstagram.ml
URL: https://verification-lnstagram.ml/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 66.85.73.153 Kansas City, United States, ASN19969 (JOESDATACENTER, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://verification-lnstagram.ml/
Origin: https://verification-lnstagram.ml

Response headers

Date: Sun, 26 Jul 2020 20:57:11 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Content-Length: 1245
Content-Type: text/html

GET
H/1.1 404
Not Found 8d4b99281427.js.indir
verification-lnstagram.ml/login_files/ 0
0 400ms
136ms Script
text/html 66.85.73.153
JOESDATACENTER

General

Check archive.org

Show headers Download Go to

Full URL: https://verification-lnstagram.ml/login_files/8d4b99281427.js.indir
Requested by: Host: verification-lnstagram.ml
URL: https://verification-lnstagram.ml/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 66.85.73.153 Kansas City, United States, ASN19969 (JOESDATACENTER, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://verification-lnstagram.ml/
Origin: https://verification-lnstagram.ml

Response headers

Date: Sun, 26 Jul 2020 20:57:11 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Content-Length: 1245
Content-Type: text/html

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 134 KB
34 KB 19ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: verification-lnstagram.ml
URL: https://verification-lnstagram.ml/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f630c6ea4e44c35a93c0ee2950e68857311d9500d6025abe4a5db3ecaf270e3c

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://verification-lnstagram.ml/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 34220
x-xss-protection: 0
pragma: public
x-fb-debug: Dzf9EmCAl7h+IWOdiK8/c0sY/3nWWC6C6IrBEViWn2vR5sFvXAfasuDN8gbZbanqEnPclOxevwjw/IKfGeFa4w==
x-fb-trip-id: 2050670934
x-frame-options: DENY
date: Sun, 26 Jul 2020 20:57:13 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET WholeInsert4.js
ads.mgmt.somee.com/serveimages/ad2/ 0
0

GET
H2 200 1425767024389221 Show response
connect.facebook.net/signals/config/ 522 KB
132 KB 304ms
304ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1425767024389221?v=2.9.22&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

89206ec18e7d49f344e50701dd6df6bc408481cb110141f1c765314a0e4bca49

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://verification-lnstagram.ml/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: 7Z+oPgQfoGzIqW6BBADq6V3AcdfpsWoesqpLURE+NLvyyPMlCSeBOqvPrnTZwYfVrcBCLjx1uKTNUqEVCKvPvg==
x-fb-trip-id: 2050670934
x-frame-options: DENY
date: Sun, 26 Jul 2020 20:57:13 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
377 B 18ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1425767024389221&ev=PageView&dl=https%3A%2F%2Fverification-lnstagram.ml%2F&rl=&if=false&ts=1595797033696&sw=1600&sh=1200&v=2.9.22&r=stable&ec=0&o=30&fbp=fb.1.1595797033694.345563303&it=1595797033338&coo=false&rqm=GET

Requested by

Host: verification-lnstagram.ml
URL: https://verification-lnstagram.ml/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://verification-lnstagram.ml/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 26 Jul 2020 20:57:13 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Sun, 26 Jul 2020 20:57:13 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
259 B 6ms
5ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1425767024389221&ev=Microdata&dl=https%3A%2F%2Fverification-lnstagram.ml%2F&rl=&if=false&ts=1595797035201&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22%5CnInstagram%5Cn%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.22&r=stable&ec=1&o=30&fbp=fb.1.1595797035201.881450229&it=1595797033338&coo=false&es=automatic&tm=3&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://verification-lnstagram.ml/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 26 Jul 2020 20:57:15 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Sun, 26 Jul 2020 20:57:15 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ads.mgmt.somee.com
URL: http://ads.mgmt.somee.com/serveimages/ad2/WholeInsert4.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Instagram (Social Network)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| _sharedData function| fbq function| _fbq

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.verification-lnstagram.ml/	1970-01-19 13:26:13	Name: _fbp Value: fb.1.1595797033694.345563303

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads.mgmt.somee.com
connect.facebook.net
i.hizliresim.com
verification-lnstagram.ml
www.facebook.com
ads.mgmt.somee.com
2606:4700:3038::681f:ea1
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
66.85.73.153
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
2aff03379d242be0fd8afca5522a5060bd7c330a11e4fb5a53a4724994036927
7d74a5d9f1403228d81025bbf28283af57a348ebb548af3962b75b2d3325e6a2
89206ec18e7d49f344e50701dd6df6bc408481cb110141f1c765314a0e4bca49
9de8c2729ae5603e5a54ebdf8bb76187a8c30d6100b3855853c58eef222f1473
f630c6ea4e44c35a93c0ee2950e68857311d9500d6025abe4a5db3ecaf270e3c

verification-lnstagram.ml Open in urlscan Pro 66.85.73.153 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

16 Requests

94 %HTTPS

75 %IPv6

5 Domains

5 Subdomains

5 IPs

2 Countries

424 kBTransfer

912 kBSize

1 Cookies

1 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

Indicators

verification-lnstagram.ml Open in urlscan Pro
66.85.73.153 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

94 %
HTTPS

75 %
IPv6

5
Domains

5
Subdomains

5
IPs

2
Countries

424 kB
Transfer

912 kB
Size

1
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!