Report - bye-bl.biz.id/id218972/login.php/

Report Overview

Submitted URL
bye-bl.biz.id/id218972/login.php/
IP
172.67.157.124
ASN
#13335 CLOUDFLARENET
Submitted
2024-05-07 12:10:40
Access
public
Website Title
Instagram • Login
Final URL
bye-bl.biz.id/id218972/login.php/
Tags
instagram meta social phishing
urlquery detections
Phishing - Instagram

Detections

urlquery
2
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
instagram.com	106	2004-06-04	2019-12-08	2024-05-05	1.4 kB	140 kB	31.13.72.174
bye-bl.biz.id	unknown	2023-11-14	2023-11-19	2024-03-12	489 B	145 kB	104.21.58.74
ajax.googleapis.com	12905	2005-01-25	2013-08-16	2024-05-07	428 B	31 kB	216.58.211.10

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-05-03	medium	bye-bl.biz.id/id218972/login.php/	Instagram

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (2)

	URL	Size	First Seen	Last Seen
	ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js	87 kB	2023-03-07	2024-05-19
Pretty URL ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js IP 216.58.211.10 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:02 Last Seen2024-05-19 15:55:42 Times Seen114797 Hash a09e13ee94d51c524b7e2a728c7d4039 0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Loading...

	bye-bl.biz.id/id218972/login.php/	1.9 kB	2023-03-25	2024-05-07
Pretty URL bye-bl.biz.id/id218972/login.php/ IP 104.21.58.74 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-25 23:28:12 Last Seen2024-05-07 14:10:42 Times Seen4 Hash 6da5a34878e6ddceb25832f4191486e8 1da0f84dedc26a72eedf3ec699b2647d8dc01db2 c27fbe0458ae8c6539358b1919a17b831733680e566419e20766358f6d395054 Loading...

HTTP Transactions (5)

URL IP Response Size

ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js

216.58.211.10

200 OK

30 kB

URL GET HTTP/2
ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js
IP
216.58.211.10:443
ASN
#15169 GOOGLE

Requested by
https://bye-bl.biz.id/id218972/login.php/
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint36:49:20:36:0C:4D:DA:55:65:64:23:0F:49:3E:FA:78:87:35:A3:79
ValidityTue, 16 Apr 2024 04:17:12 GMT - Tue, 09 Jul 2024 04:17:11 GMT

File type
JavaScript source, ASCII text, with very long lines (65451)
Size
30 kB (30399 bytes)
Hash
a09e13ee94d51c524b7e2a728c7d4039
0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

HTTP Headers

GET /ajax/libs/jquery/3.3.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bye-bl.biz.id/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 30399
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 02 May 2024 01:53:06 GMT
expires: Fri, 02 May 2025 01:53:06 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 469030
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

instagram.com/static/images/ico/favicon-192.png/b407fa101800.png

31.13.72.174

35 kB

URL GET
instagram.com/static/images/ico/favicon-192.png/b407fa101800.png
IP
31.13.72.174:0
ASN
#32934 FACEBOOK

Requested by
https://bye-bl.biz.id/id218972/login.php/
Certificate
IssuerDigiCert Inc
Subject*.instagram.com
FingerprintE8:E9:B9:98:69:04:DD:A3:35:44:BA:31:58:9B:89:B6:78:27:14:84
ValidityWed, 14 Feb 2024 00:00:00 GMT - Tue, 14 May 2024 23:59:59 GMT

File type
PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
Size
35 kB (34719 bytes)
Hash
b407fa101800e44839743a60e6078ed3
18fea4ad0371ed6cd21007f24a47812ba09b8fa1
8878662ce6afc4a995bd80c67652a72642c9564b40cfc5ac94a802d7e0f8b6b1

HTTP Headers

GET /static/images/ico/favicon-192.png/b407fa101800.png HTTP/1.1
Host: instagram.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bye-bl.biz.id/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: image/png
content-encoding: br
vary: Accept-Encoding
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
etag: "b407fa101800"
cache-control: public,max-age=31536000,immutable
edge-control: max-age=1209600, no-transform
date: Tue, 07 May 2024 12:10:17 GMT
content-length: 34719
x-fb-load: 454
x-ig-origin-region: rva
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

instagram.com/static/images/ico/favicon.ico/dfa85bb1fd63.ico

31.13.72.174

3.6 kB

URL GET
instagram.com/static/images/ico/favicon.ico/dfa85bb1fd63.ico
IP
31.13.72.174:0
ASN
#32934 FACEBOOK

Requested by
https://bye-bl.biz.id/id218972/login.php/
Certificate
IssuerDigiCert Inc
Subject*.instagram.com
FingerprintE8:E9:B9:98:69:04:DD:A3:35:44:BA:31:58:9B:89:B6:78:27:14:84
ValidityWed, 14 Feb 2024 00:00:00 GMT - Tue, 14 May 2024 23:59:59 GMT

File type
MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Size
3.6 kB (3589 bytes)
Hash
dfa85bb1fd633c2ab91c0fe07586da95
d83abdea02e3dc7f9b84841fec376fa378c0aec8
0d3b03b6b3a5d8d93f2e8e420352906459a9df4a19a34accac281e7ef1d07856

HTTP Headers

GET /static/images/ico/favicon.ico/dfa85bb1fd63.ico HTTP/1.1
Host: instagram.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bye-bl.biz.id/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: image/vnd.microsoft.icon
content-encoding: br
vary: Accept-Encoding
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
etag: "dfa85bb1fd63"
cache-control: public,max-age=31536000,immutable
edge-control: max-age=1209600, no-transform
date: Tue, 07 May 2024 12:10:17 GMT
content-length: 3589
x-fb-load: 450
x-ig-origin-region: rva
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

instagram.com/static/bundles/base/sprite_core.png/b32d382b99a8.png

31.13.72.174

101 kB

URL GET
instagram.com/static/bundles/base/sprite_core.png/b32d382b99a8.png
IP
31.13.72.174:0
ASN
#32934 FACEBOOK

Requested by
https://bye-bl.biz.id/id218972/login.php/
Certificate
IssuerDigiCert Inc
Subject*.instagram.com
FingerprintE8:E9:B9:98:69:04:DD:A3:35:44:BA:31:58:9B:89:B6:78:27:14:84
ValidityWed, 14 Feb 2024 00:00:00 GMT - Tue, 14 May 2024 23:59:59 GMT

File type
PNG image data, 544 x 542, 8-bit/color RGBA, non-interlaced
Size
101 kB (100586 bytes)
Hash
4a592454bdc6743d2cba43abcd7eb802
5f02220c7ab4c135c83bfe7e4747e805b0bd77cb
01162450adcbe1e531587d6f6c093a58950adb7f00b41d5fdff669095c57a3ac

HTTP Headers

GET /static/bundles/base/sprite_core.png/b32d382b99a8.png HTTP/1.1
Host: instagram.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bye-bl.biz.id/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: image/png
content-encoding: br
vary: Accept-Encoding
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
etag: "b32d382b99a8"
cache-control: public,max-age=31536000,immutable
edge-control: max-age=1209600, no-transform
date: Tue, 07 May 2024 12:10:18 GMT
content-length: 100586
x-fb-load: 448
x-ig-origin-region: rva
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

bye-bl.biz.id/id218972/login.php/

104.21.58.74

200 OK

144 kB

URL User Request GET HTTP/2
bye-bl.biz.id/id218972/login.php/
IP
104.21.58.74:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjectbye-bl.biz.id
Fingerprint46:0C:48:44:43:2B:57:A8:91:1B:9D:A7:26:9A:C0:E0:15:85:D2:64
ValidityMon, 11 Mar 2024 22:24:26 GMT - Sun, 09 Jun 2024 22:24:25 GMT

File type

Size
144 kB (144227 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Instagram
OpenPhish	phishing	Instagram

HTTP Headers

GET /id218972/login.php/ HTTP/1.1
Host: bye-bl.biz.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 07 May 2024 12:10:15 GMT
content-type: text/html; charset=UTF-8
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7P2IB%2FuOAjwEGCSsb%2FdUvVsfcG5kH01aWq6YaDyIKY%2B5XM70pJWOrFTEaWK7kU3S8lLjlKs2W83sX%2BzagzdQnfSEUZ6XHPcFbDtc7i7Wy%2FX8xP8%2FeEcB9HVr1Y4FAV4i"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 88011b1408f7b521-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (2)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (5)

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN