{"report_id":"79a38fcb-2066-42ba-bf7a-b756f6c236cf","version":6,"status":"done","tags":["instagram","meta","social","phishing","suspicious"],"date":"2026-05-11T16:07:34Z","url":{"schema":"https","addr":"instalgram.vercel.app/","fqdn":"instalgram.vercel.app","domain":"instalgram.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"instalgram.vercel.app/","fqdn":"instalgram.vercel.app","domain":"instalgram.vercel.app","tld":"vercel.app"},"title":"Instagram","dom":{"size":1290,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (865)","md5":"1f5fec89d396cb4d324924f49f17b1f0","sha1":"e48eb6c107c3536474355f0e7cdb7a76c0c74909","sha256":"dbbd72940e604c816bfe61172c4708370809e530bd3843b0ea10d67445d0ddd6","sha512":"ae1e8721b3b4960925f9646849226ac105dad96fccdb99113e8abf19515bef0ba8076c493be9f499412ccce9d593863dc790781bc5d674b1e75a85df3e3fa75f","ssdeep":"","tlshash":"da21db219084483713138ec829a1bf2e76c7e30bcb830918a2f913d99fd6d82c9474a9","dom_hash":"domhash67af49eec175cdc5cee091540d6ce5c5","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"instalgram.vercel.app/","fqdn":"instalgram.vercel.app","domain":"instalgram.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-15T16:07:34Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":3,"analyzer":5}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-05-11","alert":"Detects file containing Telegram Bot API","trigger":"instalgram.vercel.app/assets/index-4uhEtaM9.js","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-11","alert":"Sinkholed","trigger":"instalgram.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-11","alert":"Sinkholed","trigger":"instalgram.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-11","alert":"Phishing Block","trigger":"instalgram.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-11","alert":"Sinkholed","trigger":"instalgram.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"upload.wikimedia.org","ip":{"addr":"185.15.59.240","port":443,"asn":14907,"as":"WIKIMEDIA","country":"United States","country_code":"US"},"domain_registered":"2003-03-16","domain_rank":4329,"first_seen":"2012-05-21T09:39:45Z","last_seen":"2026-05-11T11:21:47.518969Z","alert_count":0,"request_count":1,"received_data":1337021,"sent_data":477,"comment":"","tags":null,"fingerprints":[{"name":"Apache Traffic Server:9.2.13","description":"Apache Traffic Server is an open-source caching and proxying server that serves as an HTTP/1.1 and HTTP/2 reverse proxy with caching capabilities, load balancing, request routing, SSL termination, and support for advanced HTTP features.","website":"https://trafficserver.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*","icon":"Apache Traffic Server.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"instalgram.vercel.app","ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-04-17T23:54:00.798281Z","last_seen":"2026-05-11T06:20:52.001713Z","alert_count":22,"request_count":4,"received_data":114699,"sent_data":1844,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"instalgram.vercel.app/assets/index-4uhEtaM9.js","fqdn":"instalgram.vercel.app","domain":"instalgram.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"48c530a02a23437e96bccc8597388a48","sha1":"eb6476804586cce2a50f3794b489705cb54ec222","sha256":"206faeec1ad5a3c41ff7b6628c2cbdb06a6f4fb4c4b1acfdf0c88e9aa9b4788c","sha512":"8dae5e03594080240a98efc47d7e3025fded02341c332e4ea50e43053468f01f0fccea38a78a572ebfc0fb09af1369316d3b11e0733e58ebd9fc01eca0c74635","ssdeep":"768:JgydhM8a8aGx1Vl7sX9s1h0hhjc1ufRlL8XHAL4kI0EQWdxtdo9jU/X6aMoZ04qB:Cbi+KiTXOXa7Dg2YSXtmwsgi6Bypnly","tlshash":"3c5329f43093b57293e908e6407b0402f3692955384dc8d8b1adaedf3e7684a51bbe7d","size":61701,"data":"","first_seen":"2026-04-17T23:54:05.53833Z","last_seen":"2026-05-11T16:07:35.812993Z","times_seen":7,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-05-11","alert":"Detects file containing Telegram Bot API","trigger":"instalgram.vercel.app/assets/index-4uhEtaM9.js","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"upload.wikimedia.org/wikipedia/commons/a/a5/Instagram_icon.png","fqdn":"upload.wikimedia.org","domain":"wikimedia.org","tld":"org"},"ip":{"addr":"185.15.59.240","port":443,"asn":14907,"as":"WIKIMEDIA","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://instalgram.vercel.app/","date":"2026-05-11T16:07:12.764Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.wikimedia.org","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Apr 2026 05:51:37 GMT","end":"Sun, 12 Jul 2026 05:51:36 GMT"},"fingerprint":{"sha1":"62:23:EE:89:97:A6:C1:A5:65:7A:8F:23:C2:68:CA:70:93:B3:AA:FF","sha256":"5A:21:64:0C:22:9B:01:A0:D2:BC:CA:02:4F:E8:51:ED:BA:CC:51:27:0E:87:6A:6E:E6:0D:88:64:AB:D1:3F:30"}}},"request":{"raw":"GET /wikipedia/commons/a/a5/Instagram_icon.png HTTP/1.1\r\nHost: upload.wikimedia.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://instalgram.vercel.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 11 May 2026 13:30:57 GMT\r\netag: 26d9974a1feec9905a4e0d5e5ddf8db6\r\nserver: ATS/9.2.13\r\ncontent-type: image/png\r\nx-object-meta-sha1base36: 64xlcouvih6xxskn56a47rvpplgdfww\r\nlast-modified: Tue, 12 May 2020 14:13:47 GMT\r\ncontent-length: 1335709\r\nage: 9375\r\naccept-ranges: bytes\r\nx-cache: cp3076 hit, cp3076 hit/6399\r\nx-cache-status: hit-front\r\nserver-timing: cache;desc=\"hit-front\", host;desc=\"cp3076\"\r\nstrict-transport-security: max-age=106384710; includeSubDomains; preload\r\nreport-to: { \"group\": \"wm_nel\", \"max_age\": 604800, \"endpoints\": [{ \"url\": \"https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error\u0026schema_uri=/w3c/reportingapi/network_error/1.0.0\" }] }\r\nnel: { \"report_to\": \"wm_nel\", \"max_age\": 604800, \"failure_fraction\": 0.05, \"success_fraction\": 0.0}\r\nx-client-ip: 91.90.42.154\r\nx-content-type-options: nosniff\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache\r\ntiming-allow-origin: *\r\nset-cookie: WMF-Uniq=AjI7_srhuV7-9SjSbvqUxANdAAAAAFvdIDeUXZk_bd6MIY4IJj97EPaahWGnvBCb;Domain=upload.wikimedia.org;Path=/;HttpOnly;secure;SameSite=None;Expires=Tue, 11 May 2027 00:00:00 GMT\r\nx-request-id: 49c8ee0b-db5e-4cbd-941e-7f6817ea2012\r\nx-analytics: \r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache Traffic Server:9.2.13","description":"Apache Traffic Server is an open-source caching and proxying server that serves as an HTTP/1.1 and HTTP/2 reverse proxy with caching capabilities, load balancing, request routing, SSL termination, and support for advanced HTTP features.","website":"https://trafficserver.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*","icon":"Apache Traffic Server.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1335709,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 5001 x 5001, 8-bit/color RGBA, non-interlaced","md5":"75c9ecdab121dfa8cc17274c4deebd20","sha1":"265e8557c9a49b697a84b77367decec9959bacb4","sha256":"4007695e64c8a83b51eee847712d3c4265b4617697413c5c23199b9af9b1b3b9","sha512":"8a8f0070446811dbf1b5ef4f3c27e57673acf33e3c3c7d0bd062faeb7f2211011a45a2f0b6d2a7fae77cda0226b1a9a87b0d15da495b3b98fde42f1745af0bd0","ssdeep":"24576:mIvf+FYUVHLcPMWwMLYbHWGuB4A2xMBCWcDpllTTSMXt:XOyUCkWwMEb2GuBX2xMBHQDlTvd","tlshash":"8f25233e93460de9c9a91bf4eddb0f8037b8029c02612b4783bee1699d5b31df193991","first_seen":"2023-05-21T20:10:34Z","last_seen":"2026-07-25T12:16:32.201004Z","times_seen":369,"resource_available":false,"data":null}},"time_used":264,"timings":{"blocked":49,"dns":1,"connect":17,"send":0,"wait":34,"receive":131,"ssl":29},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"instalgram.vercel.app/assets/logos-D_xJ0pYM.png","fqdn":"instalgram.vercel.app","domain":"instalgram.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://instalgram.vercel.app/","date":"2026-05-11T16:07:12.900Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Tue, 28 Apr 2026 02:04:43 GMT","end":"Mon, 27 Jul 2026 02:04:42 GMT"},"fingerprint":{"sha1":"26:33:D5:7C:A2:5E:E5:03:8C:D8:EA:45:43:9F:3B:5B:E3:1E:B6:A2","sha256":"F8:32:DF:B2:65:37:61:E8:B0:00:1D:BA:F8:4E:AB:20:66:7C:9B:FB:05:20:70:05:47:D3:B3:BF:54:81:43:AA"}}},"request":{"raw":"GET /assets/logos-D_xJ0pYM.png HTTP/1.1\r\nHost: instalgram.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://instalgram.vercel.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 1230745\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"logos-D_xJ0pYM.png\"\r\ncontent-type: image/png\r\ndate: Mon, 11 May 2026 16:07:12 GMT\r\netag: \"17e08c0471a54197fc08e092427ac404\"\r\nlast-modified: Mon, 27 Apr 2026 10:14:47 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::s7zsk-1778515632904-df5932d2cc9c\r\ncontent-length: 48995\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":48995,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced","md5":"17e08c0471a54197fc08e092427ac404","sha1":"2f193d112f58089bed86cf56307e06ebf1ffcc93","sha256":"a595c80673b41b74aaa28dde858d12f4a27eb0c2a4a9773ef9dd2dbff7f77e7f","sha512":"eb24c59fb9629b8d97cbe6ecdff124c1ebd969069d6ffa2cc1ebd14a98c3f1b7423902e061b997d3192ca5cec4257abfe50fd1da6c751e564654d5c379c87af2","ssdeep":"768:F54wncfhIc0oVfUmDU+qyvDAwIPEPxK9fkb/zacNPuFURzsVTiXc8CMMs9:LJncWIVVU+rDc9i/zaisUeGXFZ9","tlshash":"f423027401571b42b0cf432aeff98d5eace989b32ea55f3a4063c52f266a35497048f7","first_seen":"2025-11-03T14:53:49.828916Z","last_seen":"2026-05-11T16:07:35.811269Z","times_seen":9,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-11","alert":"Sinkholed","trigger":"instalgram.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-11","alert":"Sinkholed","trigger":"instalgram.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-11","alert":"Phishing Block","trigger":"instalgram.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-11","alert":"Sinkholed","trigger":"instalgram.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"instalgram.vercel.app/","fqdn":"instalgram.vercel.app","domain":"instalgram.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-11T16:07:12.443Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Tue, 28 Apr 2026 02:04:43 GMT","end":"Mon, 27 Jul 2026 02:04:42 GMT"},"fingerprint":{"sha1":"26:33:D5:7C:A2:5E:E5:03:8C:D8:EA:45:43:9F:3B:5B:E3:1E:B6:A2","sha256":"F8:32:DF:B2:65:37:61:E8:B0:00:1D:BA:F8:4E:AB:20:66:7C:9B:FB:05:20:70:05:47:D3:B3:BF:54:81:43:AA"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: instalgram.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 1716167\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline\r\ncontent-type: text/html; charset=utf-8\r\ndate: Mon, 11 May 2026 16:07:12 GMT\r\netag: \"eda98c0671f260add49abe062251b66e\"\r\nlast-modified: Tue, 21 Apr 2026 19:24:24 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::54nwk-1778515632473-e8a734d105a9\r\ncontent-length: 468\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":468,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"eda98c0671f260add49abe062251b66e","sha1":"42e4aa174426a2a875e4aeb6e2c1db20aa401df0","sha256":"a57decfb5f7211331daa1a702d284562ae55660ca9f6c96708ffc8f38a0be7d7","sha512":"95dc45c13c7e431b6db1386b644c7ae080a884cef00bd85941f4e6f9c7417544ba02e117c3d0051327ef8605bc8dc1c584123e26102f7931f8225a6c0e9a1307","ssdeep":"","tlshash":"abf0dc4584e08c15423053182ec1f80c8983fb878349de4871e3707d4fc4b828acf4bc","first_seen":"2026-04-17T23:54:05.534231Z","last_seen":"2026-05-11T16:07:35.812328Z","times_seen":7,"resource_available":false,"data":null}},"time_used":78,"timings":{"blocked":26,"dns":1,"connect":1,"send":0,"wait":11,"receive":11,"ssl":25},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-11","alert":"Phishing Block","trigger":"instalgram.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-11","alert":"Sinkholed","trigger":"instalgram.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-11","alert":"Sinkholed","trigger":"instalgram.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-11","alert":"Sinkholed","trigger":"instalgram.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"instalgram.vercel.app/assets/index-4uhEtaM9.js","fqdn":"instalgram.vercel.app","domain":"instalgram.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://instalgram.vercel.app/","date":"2026-05-11T16:07:12.715Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Tue, 28 Apr 2026 02:04:43 GMT","end":"Mon, 27 Jul 2026 02:04:42 GMT"},"fingerprint":{"sha1":"26:33:D5:7C:A2:5E:E5:03:8C:D8:EA:45:43:9F:3B:5B:E3:1E:B6:A2","sha256":"F8:32:DF:B2:65:37:61:E8:B0:00:1D:BA:F8:4E:AB:20:66:7C:9B:FB:05:20:70:05:47:D3:B3:BF:54:81:43:AA"}}},"request":{"raw":"GET /assets/index-4uhEtaM9.js HTTP/1.1\r\nHost: instalgram.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://instalgram.vercel.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\nage: 1230746\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"index-4uhEtaM9.js\"\r\ncontent-encoding: br\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Mon, 11 May 2026 16:07:12 GMT\r\netag: W/\"48c530a02a23437e96bccc8597388a48\"\r\nlast-modified: Mon, 27 Apr 2026 10:14:45 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::ncxmj-1778515632718-af9d178ac8bb\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":61701,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (33985)","md5":"48c530a02a23437e96bccc8597388a48","sha1":"eb6476804586cce2a50f3794b489705cb54ec222","sha256":"206faeec1ad5a3c41ff7b6628c2cbdb06a6f4fb4c4b1acfdf0c88e9aa9b4788c","sha512":"8dae5e03594080240a98efc47d7e3025fded02341c332e4ea50e43053468f01f0fccea38a78a572ebfc0fb09af1369316d3b11e0733e58ebd9fc01eca0c74635","ssdeep":"768:JgydhM8a8aGx1Vl7sX9s1h0hhjc1ufRlL8XHAL4kI0EQWdxtdo9jU/X6aMoZ04qB:Cbi+KiTXOXa7Dg2YSXtmwsgi6Bypnly","tlshash":"3c5329f43093b57293e908e6407b0402f3692955384dc8d8b1adaedf3e7684a51bbe7d","first_seen":"2026-04-17T23:54:05.53833Z","last_seen":"2026-05-11T16:07:35.812993Z","times_seen":7,"resource_available":true,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-05-11","alert":"Detects file containing Telegram Bot API","trigger":"instalgram.vercel.app/assets/index-4uhEtaM9.js","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-11","alert":"Phishing Block","trigger":"instalgram.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-11","alert":"Sinkholed","trigger":"instalgram.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-11","alert":"Sinkholed","trigger":"instalgram.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-11","alert":"Sinkholed","trigger":"instalgram.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"instalgram.vercel.app/assets/index-CF2llXIN.css","fqdn":"instalgram.vercel.app","domain":"instalgram.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://instalgram.vercel.app/","date":"2026-05-11T16:07:12.716Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Tue, 28 Apr 2026 02:04:43 GMT","end":"Mon, 27 Jul 2026 02:04:42 GMT"},"fingerprint":{"sha1":"26:33:D5:7C:A2:5E:E5:03:8C:D8:EA:45:43:9F:3B:5B:E3:1E:B6:A2","sha256":"F8:32:DF:B2:65:37:61:E8:B0:00:1D:BA:F8:4E:AB:20:66:7C:9B:FB:05:20:70:05:47:D3:B3:BF:54:81:43:AA"}}},"request":{"raw":"GET /assets/index-CF2llXIN.css HTTP/1.1\r\nHost: instalgram.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://instalgram.vercel.app/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\nage: 983708\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"index-CF2llXIN.css\"\r\ncontent-encoding: br\r\ncontent-type: text/css; charset=utf-8\r\ndate: Mon, 11 May 2026 16:07:12 GMT\r\netag: W/\"19bbe7c31a4fa2e455d9d7c955c08efc\"\r\nlast-modified: Thu, 30 Apr 2026 06:52:04 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::s7zsk-1778515632719-1bec8a6acde3\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1347,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1346)","md5":"19bbe7c31a4fa2e455d9d7c955c08efc","sha1":"7d4973db12d1da9e327f9b9b8d8644887fa1fcd4","sha256":"92799b7eef447dc4e94d35cd70165bf96c7c2cc7db409134eb3fd98120ff7d16","sha512":"46089f66e0b0e692f9a27dbc9eaeab48a587c0fdeee6795f4e9b1421fbb1097b14f195c045f15da6a913c7a74f8e381f3ca749aba6125e78a9320675c4a982b6","ssdeep":"","tlshash":"9f214472e109a53af02bc46428d1e5cab1018361f75b9fbde9277530caca0a31f3274c","first_seen":"2025-04-25T02:24:31.172821Z","last_seen":"2026-05-11T16:07:35.813629Z","times_seen":8,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-11","alert":"Sinkholed","trigger":"instalgram.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-11","alert":"Phishing Block","trigger":"instalgram.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-11","alert":"Sinkholed","trigger":"instalgram.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-11","alert":"Sinkholed","trigger":"instalgram.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null}]}}]}