{"report_id":"abd0aab6-0e86-4d41-9fe2-93b436446ea8","version":6,"status":"done","tags":["instagram","meta","social","phishing"],"date":"2025-10-26T14:23:34Z","url":{"schema":"http","addr":"instaclone-jpr.vercel.app","fqdn":"instaclone-jpr.vercel.app","domain":"instaclone-jpr.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"instaclone-jpr.vercel.app/login","fqdn":"instaclone-jpr.vercel.app","domain":"instaclone-jpr.vercel.app","tld":"vercel.app"},"title":"Login - Instagram","dom":{"size":1671,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (1360)","md5":"04ae08f9dd9daccbece1d33664cfc3b2","sha1":"c27470878406822b7d0d7fedb201941a90d87ee7","sha256":"7527368cf3b4e3b7b4b634c04b9ba80d79f5afd5a913112472634105ee07ffbf","sha512":"45076b038c997595b55c227afe2bb48269038f953d3b3570cf6ccb681ea79dd4022103794c0dd9bb02873be4e43d5c4eb94cfad07f742d4d6dbc1b3bd63ef3e2","ssdeep":"","tlshash":"cd31537d950294ef22034df6b2a1ae1cb4c9c70fceb39c5872bd02a763f2e916c12165","dom_hash":"domhash3d3caa4df58ac4b1939b1af40446b569","first_seen":"2025-10-26T13:38:16.541309Z","last_seen":"2025-10-26T14:23:36.123846Z","times_seen":3,"resource_available":false,"data":"PGh0bWwgbGFuZz0iZW4iPjxoZWFkPjxtZXRhIGNoYXJzZXQ9InV0Zi04Ij48bGluayByZWw9Imljb24iIGhyZWY9Ii4vZmF2aWNvbi5pY28iPjxtZXRhIG5hbWU9InZpZXdwb3J0IiBjb250ZW50PSJ3aWR0aD1kZXZpY2Utd2lkdGgsaW5pdGlhbC1zY2FsZT0xIj48dGl0bGU+TG9naW4gLSBJbnN0YWdyYW08L3RpdGxlPjxzdHlsZT5ib2R5e2JhY2tncm91bmQtY29sb3I6I2ZhZmFmYX08L3N0eWxlPjxzY3JpcHQgZGVmZXI9ImRlZmVyIiBzcmM9Ii9zdGF0aWMvanMvbWFpbi4zNjY3MDA1MS5qcyI+PC9zY3JpcHQ+PGxpbmsgaHJlZj0iL3N0YXRpYy9jc3MvbWFpbi4yYWUyZWNmYS5jc3MiIHJlbD0ic3R5bGVzaGVldCI+PC9oZWFkPjxib2R5Pjxub3NjcmlwdD5Zb3UgbmVlZCB0byBlbmFibGUgSmF2YVNjcmlwdCB0byBydW4gdGhpcyBhcHAuPC9ub3NjcmlwdD48ZGl2IGlkPSJyb290Ij48ZGl2IGNsYXNzPSJjb250YWluZXIgZmxleCBteC1hdXRvIG1heC13LXNjcmVlbi1tZCBpdGVtcy1jZW50ZXIgaC1zY3JlZW4iPjxkaXYgY2xhc3M9ImZsZXggdy0zLzUiPjxpbWcgc3JjPSIvaW1hZ2VzL2lwaG9uZS13aXRoLXByb2ZpbGUuanBnIiBhbHQ9ImlQaG9uZSB3aXRoIEluc3RhZ3JhbSBhcHAiPjwvZGl2PjxkaXYgY2xhc3M9ImZsZXggZmxleC1jb2wgdy0yLzUiPjxkaXYgY2xhc3M9ImZsZXggZmxleC1jb2wgaXRlbXMtY2VudGVyIGJnLXdoaXRlIHAtNCBib3JkZXIgYm9yZGVyLWdyYXktcHJpbWFyeSBtYi00IG1iLTQgcm91bmRlZCI+PGgxIGNsYXNzPSJmbGV4IGp1c3RpZnktY2VudGVyIHctZnVsbCI+PGltZyBzcmM9Ii9pbWFnZXMvbG9nby5wbmciIGFsdD0iSW5zdGFncmFtIiBjbGFzcz0ibXQtMiB3LTYvMTIgbWItNCI+PC9oMT48Zm9ybSBtZXRob2Q9IlBPU1QiPjxpbnB1dCBhcmlhLWxhYmVsPSJFbnRlciB5b3VyIGVtYWlsIGFkZHJlc3MiIHR5cGU9InRleHQiIHBsYWNlaG9sZGVyPSJFbWFpbCBBZGRyZXNzIiBjbGFzcz0idGV4dC1zbSB0ZXh0LWdyYXktYmFzZSB3LWZ1bGwgbXItMyBweS01IHB4LTQgaC0yIGJvcmRlciBib3JkZXItZ3JheS1wcmltYXJ5IHJvdW5kZWQgbWItMiIgdmFsdWU9IiI+PGlucHV0IGFyaWEtbGFiZWw9IkVudGVyIHlvdXIgcGFzc3dvcmQiIHR5cGU9InBhc3N3b3JkIiBwbGFjZWhvbGRlcj0iUGFzc3dvcmQiIGNsYXNzPSJ0ZXh0LXNtIHRleHQtZ3JheS1iYXNlIHctZnVsbCBtci0zIHB5LTUgcHgtNCBoLTIgYm9yZGVyIGJvcmRlci1ncmF5LXByaW1hcnkgcm91bmRlZCBtYi0yIiB2YWx1ZT0iIj48YnV0dG9uIGRpc2FibGVkPSIiIHR5cGU9InN1Ym1pdCIgY2xhc3M9ImJnLWJsdWUtbWVkaXVtIHRleHQtd2hpdGUgdy1mdWxsIHJvdW5kZWQgaC04IGZvbnQtYm9sZAogICAgICAgICAgICBvcGFjaXR5LTUwIj5Mb2dpbjwvYnV0dG9uPjwvZm9ybT48L2Rpdj48ZGl2IGNsYXNzPSJmbGV4IGp1c3RpZnktY2VudGVyIGl0ZW1zLWNlbnRlciBmbGV4LWNvbCB3LWZ1bGwgYmctd2hpdGUgcC00IHJvdW5kZWQgYm9yZGVyIGJvcmRlci1ncmF5LXByaW1hcnkiPjxwIGNsYXNzPSJ0ZXh0LXNtIj5Eb24ndCBoYXZlIGFuIGFjY291bnQ/IDxhIGNsYXNzPSJmb250LWJvbGQgdGV4dC1ibHVlLW1lZGl1bSIgaHJlZj0iL3NpZ24tdXAiPlNpZ24gdXA8L2E+PC9wPjwvZGl2PjwvZGl2PjwvZGl2PjwvZGl2PjwvYm9keT48L2h0bWw+"}},"submit":{"url":{"schema":"http","addr":"instaclone-jpr.vercel.app","fqdn":"instaclone-jpr.vercel.app","domain":"instaclone-jpr.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98","country_code":"zz"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-11-30T14:23:34Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"instaclone-jpr.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-26","alert":"Phishing Block","trigger":"instaclone-jpr.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"instaclone-jpr.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null}]},"summary":[{"fqdn":"instaclone-jpr.vercel.app","ip":{"addr":"216.198.79.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2020-01-28","domain_rank":0,"first_seen":"2025-10-26T13:38:13.048433Z","last_seen":"2025-10-26T13:38:13.048433Z","alert_count":28,"request_count":7,"received_data":2395832,"sent_data":3277,"comment":"","tags":null,"fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"instaclone-jpr.vercel.app/static/js/400.f287d1fd.chunk.js","fqdn":"instaclone-jpr.vercel.app","domain":"instaclone-jpr.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"4da33ebc87b9a27eb6a88e2aad922b45","sha1":"91d3d141913b072f7bb85ced7748a1e3fe28bb5b","sha256":"25bb0966e81254bf08684f6ced398805910046019e7032d12a1f3d862a9770c2","sha512":"99408bef6595d18d1961edbc249703c694b2a1f93ce10706138dd5011b5941e63e508b39f6d158b30b72de9c92da5bcbe0cb9ea0fa2df533e1d6fb5756da0c57","ssdeep":"","tlshash":"5b51756cb0527fefb62728f4201f580cb01e5b46c95e8d66f979382b27508897d23bd9","size":2700,"data":"","first_seen":"2025-10-26T13:38:16.546068Z","last_seen":"2025-10-26T14:23:36.126905Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"instaclone-jpr.vercel.app/static/js/main.36670051.js","fqdn":"instaclone-jpr.vercel.app","domain":"instaclone-jpr.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e35b312ba0dfb678ec5f674bb5b7e40b","sha1":"b731c0a3a21ab65ee7ede5180a8cde641b7f0cab","sha256":"e7317c5cefea335319eaf01c0b7fd042d62f55ed30521910b40fcc7636dd2ffc","sha512":"846d7d93e8840b0d1eb73dca288eaa2ba0b256a437a025085d69ee7611d8578b7c168607f63816a2288a35c84cfe0cd69ee7b1db445d8ce1fb86d7d3c609049d","ssdeep":"6144:ZqtSS7YxQvQ/Vc5imSOkayZ8pd7dzHmQIZ2M1dcMma:ZqtSSghmyZyzeXZ","tlshash":"c805c6dc72c7f02257a36176503f200ab37a2955288d8554f23ad9d6be7884db237fb8","size":829099,"data":"","first_seen":"2025-10-26T13:38:16.544288Z","last_seen":"2025-10-26T14:23:36.125304Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"instaclone-jpr.vercel.app/","fqdn":"instaclone-jpr.vercel.app","domain":"instaclone-jpr.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-26T14:23:12.956Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 22:29:14 GMT","end":"Fri, 23 Jan 2026 22:29:13 GMT"},"fingerprint":{"sha1":"6B:2C:E8:1D:DD:60:8E:79:54:CE:FA:CD:72:7F:4D:C0:7B:8E:6F:6B","sha256":"EF:F6:2B:04:2D:F4:71:55:1C:CA:FF:E3:7C:C9:DA:AB:BB:2E:C1:D2:5F:62:C5:3A:A8:D0:FC:85:01:D3:0D:1F"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: instaclone-jpr.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 10160\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"index.html\"\r\ncontent-type: text/html; charset=utf-8\r\ndate: Sun, 26 Oct 2025 14:23:13 GMT\r\netag: W/\"184123c241df8852b5caac092bb640475013e2956babdf7ba05c10585b3c5bc9\"\r\nlast-modified: Sun, 26 Oct 2025 11:33:52 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::fffjp-1761488593006-2a0285428aa2\r\ncontent-length: 476\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":476,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (476), with no line terminators","md5":"0be4d715ff3b9eff64df5a88bfcbfc65","sha1":"41ca22572f5c6e9f5d9f1aa7f93c5f96254b7f7b","sha256":"184123c241df8852b5caac092bb640475013e2956babdf7ba05c10585b3c5bc9","sha512":"1ef17c2abb75589f9b738f8dbeaaa6ca68692e97366ba94e2c93f2f88995fd6f0299eba2e2e8d5835f4eccfb6ea2ff18dbad106f56624522cb0d10d29f304c13","ssdeep":"","tlshash":"18f0d491cc11c04d37304d7a7da1f53cc84da848afa17c60bdb614768ed0b554c15440","first_seen":"2025-10-26T13:38:16.542769Z","last_seen":"2025-10-26T14:23:36.124639Z","times_seen":3,"resource_available":false,"data":null}},"time_used":115,"timings":{"blocked":47,"dns":20,"connect":1,"send":0,"wait":10,"receive":10,"ssl":24},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"instaclone-jpr.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-26","alert":"Phishing Block","trigger":"instaclone-jpr.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"instaclone-jpr.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"instaclone-jpr.vercel.app/static/js/main.36670051.js","fqdn":"instaclone-jpr.vercel.app","domain":"instaclone-jpr.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://instaclone-jpr.vercel.app/","date":"2025-10-26T14:23:13.197Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 22:29:14 GMT","end":"Fri, 23 Jan 2026 22:29:13 GMT"},"fingerprint":{"sha1":"6B:2C:E8:1D:DD:60:8E:79:54:CE:FA:CD:72:7F:4D:C0:7B:8E:6F:6B","sha256":"EF:F6:2B:04:2D:F4:71:55:1C:CA:FF:E3:7C:C9:DA:AB:BB:2E:C1:D2:5F:62:C5:3A:A8:D0:FC:85:01:D3:0D:1F"}}},"request":{"raw":"GET /static/js/main.36670051.js HTTP/1.1\r\nHost: instaclone-jpr.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://instaclone-jpr.vercel.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\nage: 9273\r\ncache-control: s-maxage=31536000, immutable\r\ncontent-disposition: inline; filename=\"main.36670051.js\"\r\ncontent-encoding: br\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Sun, 26 Oct 2025 14:23:13 GMT\r\netag: W/\"e7317c5cefea335319eaf01c0b7fd042d62f55ed30521910b40fcc7636dd2ffc\"\r\nlast-modified: Sun, 26 Oct 2025 11:48:39 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::fffjp-1761488593197-d285fd76dc92\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":829099,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65465)","md5":"e35b312ba0dfb678ec5f674bb5b7e40b","sha1":"b731c0a3a21ab65ee7ede5180a8cde641b7f0cab","sha256":"e7317c5cefea335319eaf01c0b7fd042d62f55ed30521910b40fcc7636dd2ffc","sha512":"846d7d93e8840b0d1eb73dca288eaa2ba0b256a437a025085d69ee7611d8578b7c168607f63816a2288a35c84cfe0cd69ee7b1db445d8ce1fb86d7d3c609049d","ssdeep":"6144:ZqtSS7YxQvQ/Vc5imSOkayZ8pd7dzHmQIZ2M1dcMma:ZqtSSghmyZyzeXZ","tlshash":"c805c6dc72c7f02257a36176503f200ab37a2955288d8554f23ad9d6be7884db237fb8","first_seen":"2025-10-26T13:38:16.544288Z","last_seen":"2025-10-26T14:23:36.125304Z","times_seen":3,"resource_available":true,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-26","alert":"Phishing Block","trigger":"instaclone-jpr.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"instaclone-jpr.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"instaclone-jpr.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"instaclone-jpr.vercel.app/static/css/main.2ae2ecfa.css","fqdn":"instaclone-jpr.vercel.app","domain":"instaclone-jpr.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://instaclone-jpr.vercel.app/","date":"2025-10-26T14:23:13.199Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 22:29:14 GMT","end":"Fri, 23 Jan 2026 22:29:13 GMT"},"fingerprint":{"sha1":"6B:2C:E8:1D:DD:60:8E:79:54:CE:FA:CD:72:7F:4D:C0:7B:8E:6F:6B","sha256":"EF:F6:2B:04:2D:F4:71:55:1C:CA:FF:E3:7C:C9:DA:AB:BB:2E:C1:D2:5F:62:C5:3A:A8:D0:FC:85:01:D3:0D:1F"}}},"request":{"raw":"GET /static/css/main.2ae2ecfa.css HTTP/1.1\r\nHost: instaclone-jpr.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://instaclone-jpr.vercel.app/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\nage: 9273\r\ncache-control: s-maxage=31536000, immutable\r\ncontent-disposition: inline; filename=\"main.2ae2ecfa.css\"\r\ncontent-encoding: br\r\ncontent-type: text/css; charset=utf-8\r\ndate: Sun, 26 Oct 2025 14:23:13 GMT\r\netag: W/\"87e1b67997301c5ce4d64ef860cd8ec7ffd56e1ed5c8c3a068bc0e1107777972\"\r\nlast-modified: Sun, 26 Oct 2025 11:48:39 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::ktspw-1761488593198-305228c7f364\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1429377,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (65468)","md5":"609b27e5e839eddbc9501ab2b6e8a179","sha1":"6079eb150cf18fcec68d467e8f500387ac1cc722","sha256":"671e5e335db70d8d4417a50abaaa07f1ac850994f58484d8bf5544fa47fa8d80","sha512":"7b2558be0f50e1e589153e871240be49b18770d2d0c81d5867d72897c89510815652fe9c76b4d1a8385695302150ff9362a80761b8177e8127bc0062b4251fe4","ssdeep":"12288:BuK66K40MsUsEoxnF/D6W4W4cCo2g+IrIpIXynGpCn6XsxMTGfCFur+aqMygAecm:BCxnF/DO","tlshash":"0625316e5f22242f9c7786e5d295efec611aa088dd7104e7be7314028d837b6ca1f274","first_seen":"2025-10-26T13:38:16.545202Z","last_seen":"2025-10-26T14:23:36.12612Z","times_seen":3,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"instaclone-jpr.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-26","alert":"Phishing Block","trigger":"instaclone-jpr.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"instaclone-jpr.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"instaclone-jpr.vercel.app/static/js/400.f287d1fd.chunk.js","fqdn":"instaclone-jpr.vercel.app","domain":"instaclone-jpr.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://instaclone-jpr.vercel.app/","date":"2025-10-26T14:23:13.614Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 22:29:14 GMT","end":"Fri, 23 Jan 2026 22:29:13 GMT"},"fingerprint":{"sha1":"6B:2C:E8:1D:DD:60:8E:79:54:CE:FA:CD:72:7F:4D:C0:7B:8E:6F:6B","sha256":"EF:F6:2B:04:2D:F4:71:55:1C:CA:FF:E3:7C:C9:DA:AB:BB:2E:C1:D2:5F:62:C5:3A:A8:D0:FC:85:01:D3:0D:1F"}}},"request":{"raw":"GET /static/js/400.f287d1fd.chunk.js HTTP/1.1\r\nHost: instaclone-jpr.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://instaclone-jpr.vercel.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\nage: 82657\r\ncache-control: s-maxage=31536000, immutable\r\ncontent-disposition: inline; filename=\"400.f287d1fd.chunk.js\"\r\ncontent-encoding: br\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Sun, 26 Oct 2025 14:23:13 GMT\r\netag: W/\"25bb0966e81254bf08684f6ced398805910046019e7032d12a1f3d862a9770c2\"\r\nlast-modified: Sat, 25 Oct 2025 15:25:36 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::7tjdh-1761488593622-b690adbf0b82\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2700,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (2653)","md5":"4da33ebc87b9a27eb6a88e2aad922b45","sha1":"91d3d141913b072f7bb85ced7748a1e3fe28bb5b","sha256":"25bb0966e81254bf08684f6ced398805910046019e7032d12a1f3d862a9770c2","sha512":"99408bef6595d18d1961edbc249703c694b2a1f93ce10706138dd5011b5941e63e508b39f6d158b30b72de9c92da5bcbe0cb9ea0fa2df533e1d6fb5756da0c57","ssdeep":"","tlshash":"5b51756cb0527fefb62728f4201f580cb01e5b46c95e8d66f979382b27508897d23bd9","first_seen":"2025-10-26T13:38:16.546068Z","last_seen":"2025-10-26T14:23:36.126905Z","times_seen":3,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"instaclone-jpr.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-26","alert":"Phishing Block","trigger":"instaclone-jpr.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"instaclone-jpr.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"instaclone-jpr.vercel.app/favicon.ico","fqdn":"instaclone-jpr.vercel.app","domain":"instaclone-jpr.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://instaclone-jpr.vercel.app/","date":"2025-10-26T14:23:13.653Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 22:29:14 GMT","end":"Fri, 23 Jan 2026 22:29:13 GMT"},"fingerprint":{"sha1":"6B:2C:E8:1D:DD:60:8E:79:54:CE:FA:CD:72:7F:4D:C0:7B:8E:6F:6B","sha256":"EF:F6:2B:04:2D:F4:71:55:1C:CA:FF:E3:7C:C9:DA:AB:BB:2E:C1:D2:5F:62:C5:3A:A8:D0:FC:85:01:D3:0D:1F"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: instaclone-jpr.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://instaclone-jpr.vercel.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\nage: 4893\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"favicon.ico\"\r\ncontent-encoding: br\r\ncontent-type: image/vnd.microsoft.icon\r\ndate: Sun, 26 Oct 2025 14:23:13 GMT\r\netag: W/\"0d3b03b6b3a5d8d93f2e8e420352906459a9df4a19a34accac281e7ef1d07856\"\r\nlast-modified: Sun, 26 Oct 2025 13:01:39 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::ktspw-1761488593654-a2fe4fa38b0c\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5430,"size_decoded":0,"mime_type":"image/vnd.microsoft.icon","magic":"MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel","md5":"dfa85bb1fd633c2ab91c0fe07586da95","sha1":"d83abdea02e3dc7f9b84841fec376fa378c0aec8","sha256":"0d3b03b6b3a5d8d93f2e8e420352906459a9df4a19a34accac281e7ef1d07856","sha512":"4904e784ab20b9a14bc4423176df9f7830de254619af574e20151ee9831c1e11e6e5b34a7b816bf75380c4d2d1d3d0330154d13d1745be63edae20048b32758c","ssdeep":"96:HW7QHJt9yT9kf/4ktWb0mWGlBp9bPefQMGDnC7Lm/xq+1De2v:20HY6/490mWGnpdefnGwLmY+pee","tlshash":"c2b12a66a5d02184d8af4875e382556acb23ef37d2165f8748c173f4997a2539038c3b","first_seen":"2023-04-05T15:42:50Z","last_seen":"2026-08-08T13:26:55.835244Z","times_seen":908,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"instaclone-jpr.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-26","alert":"Phishing Block","trigger":"instaclone-jpr.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"instaclone-jpr.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"instaclone-jpr.vercel.app/images/iphone-with-profile.jpg","fqdn":"instaclone-jpr.vercel.app","domain":"instaclone-jpr.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://instaclone-jpr.vercel.app/","date":"2025-10-26T14:23:13.666Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 22:29:14 GMT","end":"Fri, 23 Jan 2026 22:29:13 GMT"},"fingerprint":{"sha1":"6B:2C:E8:1D:DD:60:8E:79:54:CE:FA:CD:72:7F:4D:C0:7B:8E:6F:6B","sha256":"EF:F6:2B:04:2D:F4:71:55:1C:CA:FF:E3:7C:C9:DA:AB:BB:2E:C1:D2:5F:62:C5:3A:A8:D0:FC:85:01:D3:0D:1F"}}},"request":{"raw":"GET /images/iphone-with-profile.jpg HTTP/1.1\r\nHost: instaclone-jpr.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://instaclone-jpr.vercel.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 9263\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"iphone-with-profile.jpg\"\r\ncontent-type: image/jpeg\r\ndate: Sun, 26 Oct 2025 14:23:13 GMT\r\netag: W/\"9076047e19eab6ac6008eb8bf4d4a566825354f57b9e50ad99fe84bec8e2ad69\"\r\nlast-modified: Sun, 26 Oct 2025 11:48:50 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::zcbn9-1761488593665-e6ba4fb82873\r\ncontent-length: 120857\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":120857,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 908x1236, components 3","md5":"065afb49bc5d403aacaf846301f96faf","sha1":"131a3463481d0fd829b196100e96a70808cce967","sha256":"9076047e19eab6ac6008eb8bf4d4a566825354f57b9e50ad99fe84bec8e2ad69","sha512":"7dc982a4930877d9303e1d45243e84cc98dfb74719614dc204049d750b21ca3d632d403e5d48eaad899c7bd8c88ccffafa3e6e02b10e03beb7f9dba5d2e1bce4","ssdeep":"3072:dJ7MJR5blUEo0bQQB1Ly3c6STCI3sl1PY:d1cRHUEz9/ypSmI3sl1Y","tlshash":"f6c302bb6dcb1cc0e318b5b6e3a4946647a33fa3d74411fd12da9744fc93aa38293548","first_seen":"2023-06-04T01:18:09Z","last_seen":"2026-07-24T06:16:49.519482Z","times_seen":167,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-26","alert":"Phishing Block","trigger":"instaclone-jpr.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"instaclone-jpr.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"instaclone-jpr.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"instaclone-jpr.vercel.app/images/logo.png","fqdn":"instaclone-jpr.vercel.app","domain":"instaclone-jpr.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://instaclone-jpr.vercel.app/","date":"2025-10-26T14:23:13.680Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 22:29:14 GMT","end":"Fri, 23 Jan 2026 22:29:13 GMT"},"fingerprint":{"sha1":"6B:2C:E8:1D:DD:60:8E:79:54:CE:FA:CD:72:7F:4D:C0:7B:8E:6F:6B","sha256":"EF:F6:2B:04:2D:F4:71:55:1C:CA:FF:E3:7C:C9:DA:AB:BB:2E:C1:D2:5F:62:C5:3A:A8:D0:FC:85:01:D3:0D:1F"}}},"request":{"raw":"GET /images/logo.png HTTP/1.1\r\nHost: instaclone-jpr.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://instaclone-jpr.vercel.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 9263\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"logo.png\"\r\ncontent-type: image/png\r\ndate: Sun, 26 Oct 2025 14:23:13 GMT\r\netag: W/\"b9c604018a550b63d359608469904de09b8efc5f38395cca106faa49262dfde0\"\r\nlast-modified: Sun, 26 Oct 2025 11:48:50 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::zcbn9-1761488593673-b96f51471f5a\r\ncontent-length: 3841\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3841,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 206 x 58, 8-bit colormap, non-interlaced","md5":"c46f54e523f2656d2f518d51623448a0","sha1":"d8f8311ae18fcd2b0d9bea85eb29a20e209518f8","sha256":"b9c604018a550b63d359608469904de09b8efc5f38395cca106faa49262dfde0","sha512":"9eb3830d8647d31cfbb5587c5fe0c06066e95bbeb23c3c65076eeb6448ec6d42c615fc42eba446af054866e15fefc7c9d205df4846d886b0242b76fba7e5602a","ssdeep":"","tlshash":"be810bd2b4a76ae747b49f5113467c77c43863c7454a915a682fa04f67387d20185790","first_seen":"2023-05-10T00:48:35Z","last_seen":"2026-08-08T13:26:55.83234Z","times_seen":689,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"instaclone-jpr.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-26","alert":"Phishing Block","trigger":"instaclone-jpr.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"instaclone-jpr.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null}]}}]}