lnstagramverification-bussineshelp-teamcenter.ml
Open in
urlscan Pro
2606:4700:3036::ac43:b434
Malicious Activity!
Public Scan
Submission: On January 16 via automatic, source openphish
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on December 31st 2020. Valid for: a year.
This is the only time lnstagramverification-bussineshelp-teamcenter.ml was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Instagram (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2606:4700:303... 2606:4700:3036::ac43:b434 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:814::2001 | 15169 (GOOGLE) (GOOGLE) | |
3 6 | 2606:4700:303... 2606:4700:3033::6815:3430 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:80b::2001 | 15169 (GOOGLE) (GOOGLE) | |
6 | 4 |
ASN13335 (CLOUDFLARENET, US)
lnstagramverification-bussineshelp-teamcenter.ml |
ASN15169 (GOOGLE, US)
ci4.googleusercontent.com |
ASN13335 (CLOUDFLARENET, US)
resimag.com | |
www.resimag.com |
ASN15169 (GOOGLE, US)
ci6.googleusercontent.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
resimag.com
3 redirects
resimag.com www.resimag.com |
1 KB |
2 |
googleusercontent.com
ci4.googleusercontent.com ci6.googleusercontent.com |
1 MB |
1 |
lnstagramverification-bussineshelp-teamcenter.ml
lnstagramverification-bussineshelp-teamcenter.ml |
2 KB |
6 | 3 |
Domain | Requested by | |
---|---|---|
3 | www.resimag.com |
lnstagramverification-bussineshelp-teamcenter.ml
|
3 | resimag.com | 3 redirects |
1 | ci6.googleusercontent.com |
lnstagramverification-bussineshelp-teamcenter.ml
|
1 | ci4.googleusercontent.com |
lnstagramverification-bussineshelp-teamcenter.ml
|
1 | lnstagramverification-bussineshelp-teamcenter.ml | |
6 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-12-31 - 2021-12-30 |
a year | crt.sh |
*.googleusercontent.com GTS CA 1O1 |
2020-12-15 - 2021-03-09 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://lnstagramverification-bussineshelp-teamcenter.ml/
Frame ID: 35778D11D25625A3875D80FAB91DEA43
Requests: 6 HTTP requests in this frame
Screenshot
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /^cloudflare$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 1- https://resimag.com/p1/819f2f28aae.png HTTP 302
- https://www.resimag.com/404page.html
- https://resimag.com/p1/b6a0e4390db.png HTTP 302
- https://www.resimag.com/404page.html
- https://resimag.com/p1/45ce843a3fd.png HTTP 302
- https://www.resimag.com/404page.html
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
lnstagramverification-bussineshelp-teamcenter.ml/ |
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sKqXcB7zDP7N-6yY75yXsKOC97B-g-pZSdkWFTKh02EVUCA277wXPS-5JGPMeRBHAKdRtnZv=s0-d-e1-ft
ci4.googleusercontent.com/proxy/ |
785 KB 786 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
404page.html
www.resimag.com/ Redirect Chain
|
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headersRedirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1nzWmt3zgNYueUHtay9q_z3jdPD7IfplMhToVaTNHeqFGmzl-OeOo0KjN7EE5gAllJPpdiiz=s0-d-e1-ft
ci6.googleusercontent.com/proxy/ |
304 KB 305 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
404page.html
www.resimag.com/ Redirect Chain
|
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headersRedirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
404page.html
www.resimag.com/ Redirect Chain
|
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headersRedirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Instagram (Social Network)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.lnstagramverification-bussineshelp-teamcenter.ml/ | Name: ARRAffinity Value: d61f024805f40cb35582d6dec4c50737546e03858cb05de2ce595b7e89683db2 |
|
.lnstagramverification-bussineshelp-teamcenter.ml/ | Name: __cfduid Value: dcc7e5848f5e4cc85db6a3502b8f303961610759387 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ci4.googleusercontent.com
ci6.googleusercontent.com
lnstagramverification-bussineshelp-teamcenter.ml
resimag.com
www.resimag.com
2606:4700:3033::6815:3430
2606:4700:3036::ac43:b434
2a00:1450:4001:80b::2001
2a00:1450:4001:814::2001
2fd54e67fc428aa4500992b20556ec4291b7efc1527397c8784bb58176e28360
34b405bf58c292a06f7e755b46ff12cfaf230d5f4a0f6368298c63e1c76f25fc
766eba871c4341d668c6f9e901b97daedaf7e11dca64e2695ff8811a4ba1e318
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855