{"report_id":"bb40d8bf-c644-45de-9813-48918057ce83","version":6,"status":"done","tags":["instagram","meta","social","phishing"],"date":"2025-11-01T11:23:51Z","url":{"schema":"http","addr":"instagramlogin-eta.vercel.app/","fqdn":"instagramlogin-eta.vercel.app","domain":"instagramlogin-eta.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.67","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"instagramlogin-eta.vercel.app/","fqdn":"instagramlogin-eta.vercel.app","domain":"instagramlogin-eta.vercel.app","tld":"vercel.app"},"title":"Instagram","dom":{"size":5488,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1380)","md5":"0ff3a0eba6f90551eabf191b438286f8","sha1":"0964135bfefec1169d77dc849f6abb5a3a272a15","sha256":"a0fdefd8dd8622e2008f4410cc101d9e7e26add3aabc2a3bc4750d6c18bd5af4","sha512":"835e9382b49b8c4836031c9cf3d1f0ea8213334e5f9db4b404515a69e0e852b681695c6e2cfcb9e71eb6352b809b1afcb41498ef496deb760145ac2f235a8c4a","ssdeep":"48:ne8Utzuj/UMDZGmZ3meax7BhpseGY9BE1BVEBOrNBiEYG25sj9tGzqblc0Vq/WBz:ncaUMFH3FaXrBL6uwbirsjzsq5Vqs3Vj","tlshash":"b5b1b55209f2897b09c0d7d039246e1d6e83d053e911a84872be3a9fdfe9f538e2745e","dom_hash":"domhashb37153950f0879c78f88f57373ad762d","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":"PGh0bWwgbGFuZz0iZW4iPjxoZWFkPgogICAgPG1ldGEgY2hhcnNldD0iVVRGLTgiPgogICAgPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCwgaW5pdGlhbC1zY2FsZT0xLjAiPgogICAgPHRpdGxlPkluc3RhZ3JhbTwvdGl0bGU+CiAgICA8bGluayByZWw9InN0eWxlc2hlZXQiIGhyZWY9InN0eWxlLmNzcyI+CiAgICA8bGluayByZWw9InNob3J0Y3V0IGljb24iIGhyZWY9ImRhdGE6aW1hZ2UvcG5nO2Jhc2U2NCxpVkJPUncwS0dnb0FBQUFOU1VoRVVnQUFBQndBQUFBY0NBTUFBQUJGMHkrbUFBQUJPRkJNVkVWSGNFeHhGLzEzRi8xekZmMkFGdjJNQ3UraUJPbXlBdUxFQWQ3U0FOcmFCTXp3SHBlZEkrWGVBTmZtQU5IbUFyK1BGLzZmRC92eEFMN3FBclY3R1AyMUZ2blJWdXJuWitQMlo5cm9RZUR6R3RYekI4djdBcXZXaVBuKzdmbi8vLy83ZnR2L0E3ejBCS0gzdi9IKzNmVCtydWorQUpyLzkvci9SY0QvYk1ES0ZmZi9CbzNpRytyOEdyWC9BSUgrSDVyL3llUCtCSGovdDluL1Y1citBbTcrSDM3K0JHVC9zc1gvSW16L1JYdi91Y3orZTR6K0pGVC9YSTMvTUdMK0xVZi91N2YveWM3L0FscitPVWYrTVN6K1F6VCtSMFQraUhEK1NSaitWekgrV1FYK0FrTCtjMkwvMHNUK2FDWCtjQkwvNytqK2FRTCtlUnYvb1VYL2Z3TCtpQkQvd1h6K2pnRC8zcnIvMXJuK2RneituQVA5RnBUK2x3NytxZ0grdFFEK3ZRRC93MWY5a3dmL3hBRDlQRm45b2dqL3l3RDl1QWZnTFpMQkFBQUFhSFJTVGxNQVc5SCsvLy8vLy8vL3hFc0MvLy9OLy8vL3pGei8vLy8vLy8vLy8vLy8vLy8vdVAvLy8vNy8vLy8vLy8vLy8vNy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vRi83VlEvLy8rLzg3L3Zzai91cUwwR1F3QUFBSGNTVVJCVkhnQlJNbEZlaHd4RUVEaFYxVlMwNHlaN1UwNG0rQW1jQmpmTExzY0o0eExIeUEwWUdxU2xKN1A5TVQ2QlJDNTJFRVF1RGpsRklUeDJlV3ZYSnNEUVdZSUtnSmo0VlFXNWdCSkFnNzVLNXZUZ1pEVEZVRXUva1VFenFHYWlDNkRNQmJocHFReW95S1ROWUQxSHArVWk2SjBaSDFIaFhOQTBSZnp5UklabDVXcHJyb0szQlp3d3Z4MGFVR2RCODdIQ0lONVZCVVZQOWk0NjhaTHhXTHYrcGc2dkptRGFTaVNXMmV5SVJOZzg0L0h4ZlZKbVREM0R4RldHbVdqcm9zUnB4TU5HcjNpSXFZYkc3SUdLNWxLdlpFM2pWdVR5bnNEekhSb0QzeHB4YVRRdklLdW1HQldnQ291TTliUEtFaXNKZzBWVFY0WDBhQnFRRXVYUTJrR2xtVm1aQ3RnQ294QkpmZUF6MGI4TlFiV0k3d09BS0NaTWdibjlFNnRJdEcxSEZUS1JRNGpnU1lwaWlQdTZCRkpXMWZXOUo3b0RGV1dncGYwTUgwOVluQjZ5SUVZbklKaExocWtwdzNhQzRPdVVKNFFsRHpYNTUvVW01bTRVZTZkbVhyNTlMd2tCTTB4eS9pZVZOVjd6U1NUWk1VM2ZzOFVOQm9tcit2M2pReDVYMVhtQjd0ZGduTnUxSnFEbCswbmJucCtIcExwK1dNNWJCMG1JTUpGYy9vdVNnamQrVTk5TzFxWU9OT2hGRU1vblBjWkNaNmVHcDllUmNTd2hXa1NSQ0l4S25mZUlNQmgxV1JjRk9oVGFFTm8vMDk2T1RBN0FBQ0R6S09ERFRoYWtnQUFBQUJKUlU1RXJrSmdnZz09IiB0eXBlPSJpbWFnZS94LWljb24iPgo8L2hlYWQ+Cjxib2R5PgogICAgPGRpdiBjbGFzcz0iY29udGFpbmVyIj4KICAgICAgICA8ZGl2IGNsYXNzPSJwaG9uZS1jb250YWluZXIiPgogICAgICAgICAgICA8ZGl2IGNsYXNzPSJwaG9uZS1tb2NrdXAiPgogICAgICAgICAgICAgICAgPGRpdiBjbGFzcz0iY2Fyb3VzZWwiPgogICAgICAgICAgICAgICAgICAgIDxpbWcgc3JjPSJodHRwczovL3d3dy5pbnN0YWdyYW0uY29tL3N0YXRpYy9pbWFnZXMvaG9tZXBhZ2Uvc2NyZWVuc2hvdHMvc2NyZWVuc2hvdDEucG5nL2ZkZmUyMzliN2M5Zi5wbmciIGFsdD0iSW5zdGFncmFtIHNjcmVlbnNob3QgMSIgY2xhc3M9ImFjdGl2ZSI+CiAgICAgICAgICAgICAgICAgICAgPGltZyBzcmM9Imh0dHBzOi8vd3d3Lmluc3RhZ3JhbS5jb20vc3RhdGljL2ltYWdlcy9ob21lcGFnZS9zY3JlZW5zaG90cy9zY3JlZW5zaG90Mi5wbmcvNGQ2MmFjYjY2N2ZiLnBuZyIgYWx0PSJJbnN0YWdyYW0gc2NyZWVuc2hvdCAyIj4KICAgICAgICAgICAgICAgICAgICA8aW1nIHNyYz0iaHR0cHM6Ly93d3cuaW5zdGFncmFtLmNvbS9zdGF0aWMvaW1hZ2VzL2hvbWVwYWdlL3NjcmVlbnNob3RzL3NjcmVlbnNob3QzLnBuZy85NGVkYjc3MGFjY2YucG5nIiBhbHQ9Ikluc3RhZ3JhbSBzY3JlZW5zaG90IDMiPgogICAgICAgICAgICAgICAgICAgIDxpbWcgc3JjPSJodHRwczovL3d3dy5pbnN0YWdyYW0uY29tL3N0YXRpYy9pbWFnZXMvaG9tZXBhZ2Uvc2NyZWVuc2hvdHMvc2NyZWVuc2hvdDQucG5nL2E0ZmQ4MjVlM2Q0OS5wbmciIGFsdD0iSW5zdGFncmFtIHNjcmVlbnNob3QgNCI+CiAgICAgICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgPC9kaXY+CiAgICAgICAgCiAgICAgICAgPGRpdiBjbGFzcz0ibG9naW4tY29udGFpbmVyIj4KICAgICAgICAgICAgPGRpdiBjbGFzcz0ibG9naW4tYm94Ij4KICAgICAgICAgICAgICAgIDxpbWcgc3JjPSJodHRwczovL3d3dy5pbnN0YWdyYW0uY29tL3N0YXRpYy9pbWFnZXMvd2ViL2xvZ2dlZF9vdXRfd29yZG1hcmsucG5nLzdhMjUyZGUwMGIyMC5wbmciIGFsdD0iSW5zdGFncmFtIiBjbGFzcz0ibG9nbyI+CiAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgIDxkaXYgY2xhc3M9ImZvcm0tY29udGFpbmVyIj4KICAgICAgICAgICAgICAgICAgICA8Zm9ybSBpZD0ibG9naW4tZm9ybSIgYWN0aW9uPSIvbG9naW4iIG1ldGhvZD0icG9zdCI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJ1c2VybmFtZSIgY2xhc3M9ImlucHV0LWZpZWxkIiBwbGFjZWhvbGRlcj0iUGhvbmUgbnVtYmVyLCB1c2VybmFtZSwgb3IgZW1haWwiIHJlcXVpcmVkPSIiPgogICAgICAgICAgICAgICAgICAgICAgICA8aW5wdXQgdHlwZT0icGFzc3dvcmQiIG5hbWU9InBhc3dvcmQiIGNsYXNzPSJpbnB1dC1maWVsZCIgcGxhY2Vob2xkZXI9IlBhc3N3b3JkIiByZXF1aXJlZD0iIj4KICAgICAgICAgICAgICAgICAgICAgICAgPGJ1dHRvbiB0eXBlPSJzdWJtaXQiIGNsYXNzPSJsb2dpbi1idXR0b24iPkxvZyBJbjwvYnV0dG9uPgogICAgICAgICAgICAgICAgICAgIDwvZm9ybT4KICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICA8ZGl2IGNsYXNzPSJkaXZpZGVyIj4KICAgICAgICAgICAgICAgICAgICAgICAgPHNwYW4+T1I8L3NwYW4+CiAgICAgICAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgPGEgaHJlZj0iIyIgY2xhc3M9ImZiLWxvZ2luIj4KICAgICAgICAgICAgICAgICAgICAgICAgPHN2ZyBjbGFzcz0iZmItaWNvbiIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB2aWV3Qm94PSIwIDAgMjQgMjQiIGZpbGw9IiMzODUxODUiPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPHBhdGggZD0iTTIwLjksMkgzLjFDMi41LDIsMiwyLjUsMiwzLjF2MTcuOGMwLDAuNiwwLjUsMS4xLDEuMSwxLjFoOS42di03LjdoLTIuNnYtM2gyLjZWOS4yYzAtMi42LDEuNi00LDMuOS00YzEuMSwwLDIuMSwwLjEsMi4zLDAuMXYyLjdsLTEuNiwwYy0xLjMsMC0xLjUsMC42LTEuNSwxLjV2MS45aDNsLTAuNCwzaC0yLjZWMjJoNS4xYzAuNiwwLDEuMS0wLjUsMS4xLTEuMVYzLjFDMjIsMi41LDIxLjUsMiwyMC45LDJ6Ij48L3BhdGg+CiAgICAgICAgICAgICAgICAgICAgICAgIDwvc3ZnPgogICAgICAgICAgICAgICAgICAgICAgICBMb2cgaW4gd2l0aCBGYWNlYm9vawogICAgICAgICAgICAgICAgICAgIDwvYT4KICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICA8YSBocmVmPSIjIiBjbGFzcz0iZm9yZ290LXB3Ij5Gb3Jnb3QgcGFzc3dvcmQ/PC9hPgogICAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAKICAgICAgICAgICAgPGRpdiBjbGFzcz0ic2lnbnVwLWJveCI+CiAgICAgICAgICAgICAgICBEb24ndCBoYXZlIGFuIGFjY291bnQ/IDxhIGhyZWY9IiMiPlNpZ24gdXA8L2E+CiAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAKICAgICAgICAgICAgPGRpdiBjbGFzcz0iYXBwLWRvd25sb2FkIj4KICAgICAgICAgICAgICAgIDxwPkdldCB0aGUgYXBwLjwvcD4KICAgICAgICAgICAgICAgIDxkaXYgY2xhc3M9ImRvd25sb2FkLWJhZGdlcyI+CiAgICAgICAgICAgICAgICAgICAgPGEgaHJlZj0iIyI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxpbWcgc3JjPSJodHRwczovL3d3dy5pbnN0YWdyYW0uY29tL3N0YXRpYy9pbWFnZXMvYXBwc3RvcmUtaW5zdGFsbC1iYWRnZXMvYmFkZ2VfaW9zX2VuZ2xpc2gtZW4ucG5nLzE4MGFlN2EwYmNmNy5wbmciIGFsdD0iRG93bmxvYWQgb24gdGhlIEFwcCBTdG9yZSI+CiAgICAgICAgICAgICAgICAgICAgPC9hPgogICAgICAgICAgICAgICAgICAgIDxhIGhyZWY9IiMiPgogICAgICAgICAgICAgICAgICAgICAgICA8aW1nIHNyYz0iaHR0cHM6Ly93d3cuaW5zdGFncmFtLmNvbS9zdGF0aWMvaW1hZ2VzL2FwcHN0b3JlLWluc3RhbGwtYmFkZ2VzL2JhZGdlX2FuZHJvaWRfZW5nbGlzaC1lbi5wbmcvZTljZDg0NmRjNzQ4LnBuZyIgYWx0PSJHZXQgaXQgb24gR29vZ2xlIFBsYXkiPgogICAgICAgICAgICAgICAgICAgIDwvYT4KICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICA8Zm9vdGVyPgogICAgICAgIDxuYXY+CiAgICAgICAgICAgIDxhIGhyZWY9IiMiPk1ldGE8L2E+CiAgICAgICAgICAgIDxhIGhyZWY9IiMiPkFib3V0PC9hPgogICAgICAgICAgICA8YSBocmVmPSIjIj5CbG9nPC9hPgogICAgICAgICAgICA8YSBocmVmPSIjIj5Kb2JzPC9hPgogICAgICAgICAgICA8YSBocmVmPSIjIj5IZWxwPC9hPgogICAgICAgICAgICA8YSBocmVmPSIjIj5BUEk8L2E+CiAgICAgICAgICAgIDxhIGhyZWY9IiMiPlByaXZhY3k8L2E+CiAgICAgICAgICAgIDxhIGhyZWY9IiMiPlRlcm1zPC9hPgogICAgICAgICAgICA8YSBocmVmPSIjIj5Ub3AgQWNjb3VudHM8L2E+CiAgICAgICAgICAgIDxhIGhyZWY9IiMiPkxvY2F0aW9uczwvYT4KICAgICAgICAgICAgPGEgaHJlZj0iIyI+SW5zdGFncmFtIExpdGU8L2E+CiAgICAgICAgICAgIDxhIGhyZWY9IiMiPkNvbnRhY3QgVXBsb2FkaW5nICZhbXA7IE5vbi1Vc2VyczwvYT4KICAgICAgICA8L25hdj4KICAgICAgICA8ZGl2IHN0eWxlPSJtYXJnaW4tdG9wOiAxMnB4OyI+CiAgICAgICAgICAgIDxzcGFuPkVuZ2xpc2g8L3NwYW4+CiAgICAgICAgICAgIDxzcGFuPsKpIDIwMjQgSW5zdGFncmFtIGZyb20gTWV0YTwvc3Bhbj4KICAgICAgICA8L2Rpdj4KICAgIDwvZm9vdGVyPgo8L2Rpdj4KPC9kaXY+CjwvZGl2Pgo8c2NyaXB0IHNyYz0ic2NyaXRwdC5qcyI+PC9zY3JpcHQ+Cgo8L2JvZHk+PC9odG1sPg=="}},"submit":{"url":{"schema":"http","addr":"instagramlogin-eta.vercel.app/","fqdn":"instagramlogin-eta.vercel.app","domain":"instagramlogin-eta.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.67","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"tags":null,"meta":null,"user":{"country_code":"zz"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-12-06T11:23:51Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":6}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"instagramlogin-eta.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"url","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Instagram","trigger":"instagramlogin-eta.vercel.app/","verdict":"phishing","severity":"medium","comment":"Instagram","link":"https://openphish.com","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-01","alert":"Phishing Block","trigger":"instagramlogin-eta.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"instagramlogin-eta.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"instagramlogin-eta.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Instagram","trigger":"instagramlogin-eta.vercel.app","verdict":"phishing","severity":"medium","comment":"Instagram","link":"https://openphish.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null}]},"summary":[{"fqdn":"instagramlogin-eta.vercel.app","ip":{"addr":"216.198.79.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2020-01-28","domain_rank":0,"first_seen":"2025-10-16T07:34:15.822932Z","last_seen":"2025-11-01T03:07:44.266756Z","alert_count":18,"request_count":3,"received_data":11868,"sent_data":1397,"comment":"","tags":null,"fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"instagramlogin-eta.vercel.app/scritpt.js","fqdn":"instagramlogin-eta.vercel.app","domain":"instagramlogin-eta.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"08a57892ab41f428baf279c9f21f9471","sha1":"74ba524f379bba0e208cc6d906a4dc42b5d748f7","sha256":"24d7a6ce498d49a93ba9985843f8174420103093dbd57c245073b94b011a3ff1","sha512":"d4d2b6c004920dc0f521d902a1c58bbf73903faf2cb6152ea2390c8501d29f01f8698b1bcd451c628e0c2b36b1d1adc8ce5c99de06ccc06c0413f6f30edc3b91","ssdeep":"","tlshash":"84218e1632681d33996a22f1614f6127157d1863ef4c9d053eff84844bd1ea802a9fdf","size":1297,"data":"","first_seen":"2025-10-16T07:34:17.577897Z","last_seen":"2025-11-01T11:23:52.130607Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"instagramlogin-eta.vercel.app/","fqdn":"instagramlogin-eta.vercel.app","domain":"instagramlogin-eta.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-11-01T11:23:29.064Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 22:29:14 GMT","end":"Fri, 23 Jan 2026 22:29:13 GMT"},"fingerprint":{"sha1":"6B:2C:E8:1D:DD:60:8E:79:54:CE:FA:CD:72:7F:4D:C0:7B:8E:6F:6B","sha256":"EF:F6:2B:04:2D:F4:71:55:1C:CA:FF:E3:7C:C9:DA:AB:BB:2E:C1:D2:5F:62:C5:3A:A8:D0:FC:85:01:D3:0D:1F"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: instagramlogin-eta.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 10220\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=utf-8\r\ndate: Sat, 01 Nov 2025 11:23:29 GMT\r\netag: \"3989ebe175f3d57ad9e14ed12d9a86ab\"\r\nlast-modified: Sat, 01 Nov 2025 08:33:08 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::4bvkx-1761996209093-6dcd325cab75\r\ncontent-length: 2421\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5489,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1380)","md5":"3989ebe175f3d57ad9e14ed12d9a86ab","sha1":"d5711047d7d6d55aa4091b60c3b63f0cd4bc2de8","sha256":"5d62589ea80b938c1dce8f8a6897161b1f51e838f3b90cba0c71944594da49dc","sha512":"4f4c398c0838c23fd401e339cce000e7426520cf14b928789f0c4d094b5808b5c05f4d9baf0c7f5874257e4e9e1ea2f128b467804a0b39087eb48d623ae29433","ssdeep":"48:g8Utzuj/UMDZGmZ3meax7BhpseGY9BE1BVEBOrNBiEYG25sjyt5zqblc0GRq/WBQ:maUMFH3FaXrBL6uwbirsj0Vq5GRqs+T","tlshash":"fbb1c45209f2897b09c0d6d039246e1d2e83d153e911a84872fe395fdfe8f538e2745e","first_seen":"2025-10-16T07:34:17.574128Z","last_seen":"2025-11-01T11:23:52.128982Z","times_seen":6,"resource_available":false,"data":null}},"time_used":77,"timings":{"blocked":26,"dns":1,"connect":1,"send":0,"wait":10,"receive":12,"ssl":24},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"instagramlogin-eta.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"url","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Instagram","trigger":"instagramlogin-eta.vercel.app/","verdict":"phishing","severity":"medium","comment":"Instagram","link":"https://openphish.com","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-01","alert":"Phishing Block","trigger":"instagramlogin-eta.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"instagramlogin-eta.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"instagramlogin-eta.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"instagramlogin-eta.vercel.app/style.css","fqdn":"instagramlogin-eta.vercel.app","domain":"instagramlogin-eta.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://instagramlogin-eta.vercel.app/","date":"2025-11-01T11:23:29.316Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 22:29:14 GMT","end":"Fri, 23 Jan 2026 22:29:13 GMT"},"fingerprint":{"sha1":"6B:2C:E8:1D:DD:60:8E:79:54:CE:FA:CD:72:7F:4D:C0:7B:8E:6F:6B","sha256":"EF:F6:2B:04:2D:F4:71:55:1C:CA:FF:E3:7C:C9:DA:AB:BB:2E:C1:D2:5F:62:C5:3A:A8:D0:FC:85:01:D3:0D:1F"}}},"request":{"raw":"GET /style.css HTTP/1.1\r\nHost: instagramlogin-eta.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://instagramlogin-eta.vercel.app/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 5731\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"style.css\"\r\ncontent-encoding: br\r\ncontent-type: text/css; charset=utf-8\r\ndate: Sat, 01 Nov 2025 11:23:29 GMT\r\netag: \"6159353725d1adf70b485c328794debe\"\r\nlast-modified: Sat, 01 Nov 2025 09:47:57 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::flwtj-1761996209305-361e55ae4557\r\ncontent-length: 1142\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3360,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"5576a2f135b4552f7211120f2f1cb106","sha1":"e77e6e30157719e6aa2e48ca6538fcc5554195b1","sha256":"69497dc4fc051e145b643f9aeea62fdbcb0f22ca279365d70e96d8b6323096ad","sha512":"e39b1a19d7cb020febc5c41e5c8fef0b65c6a5c03a826e48fbba7a96b94fe3fcd99e4e8aea144e181a2635e9fdf5736f9c2b68f6847efd4b520d466f7f0bf0d4","ssdeep":"","tlshash":"876131d72b782504794bd8a438129b11b26a8493c60fcd7c5bf5249cdd8d2da2673f8c","first_seen":"2025-10-16T07:34:17.570723Z","last_seen":"2025-11-01T11:23:52.129876Z","times_seen":6,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-01","alert":"Phishing Block","trigger":"instagramlogin-eta.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"instagramlogin-eta.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Instagram","trigger":"instagramlogin-eta.vercel.app","verdict":"phishing","severity":"medium","comment":"Instagram","link":"https://openphish.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"instagramlogin-eta.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"instagramlogin-eta.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"instagramlogin-eta.vercel.app/scritpt.js","fqdn":"instagramlogin-eta.vercel.app","domain":"instagramlogin-eta.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.195","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://instagramlogin-eta.vercel.app/","date":"2025-11-01T11:23:29.323Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 22:29:14 GMT","end":"Fri, 23 Jan 2026 22:29:13 GMT"},"fingerprint":{"sha1":"6B:2C:E8:1D:DD:60:8E:79:54:CE:FA:CD:72:7F:4D:C0:7B:8E:6F:6B","sha256":"EF:F6:2B:04:2D:F4:71:55:1C:CA:FF:E3:7C:C9:DA:AB:BB:2E:C1:D2:5F:62:C5:3A:A8:D0:FC:85:01:D3:0D:1F"}}},"request":{"raw":"GET /scritpt.js HTTP/1.1\r\nHost: instagramlogin-eta.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://instagramlogin-eta.vercel.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 1747552\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"scritpt.js\"\r\ncontent-encoding: br\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Sat, 01 Nov 2025 11:23:29 GMT\r\netag: \"3aca94079981f96d8bf6094fd69af6ee\"\r\nlast-modified: Sun, 12 Oct 2025 05:57:36 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::flwtj-1761996209324-c30f3c8dce06\r\ncontent-length: 560\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":1297,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text","md5":"08a57892ab41f428baf279c9f21f9471","sha1":"74ba524f379bba0e208cc6d906a4dc42b5d748f7","sha256":"24d7a6ce498d49a93ba9985843f8174420103093dbd57c245073b94b011a3ff1","sha512":"d4d2b6c004920dc0f521d902a1c58bbf73903faf2cb6152ea2390c8501d29f01f8698b1bcd451c628e0c2b36b1d1adc8ce5c99de06ccc06c0413f6f30edc3b91","ssdeep":"","tlshash":"84218e1632681d33996a22f1614f6127157d1863ef4c9d053eff84844bd1ea802a9fdf","first_seen":"2025-10-16T07:34:17.577897Z","last_seen":"2025-11-01T11:23:52.130607Z","times_seen":6,"resource_available":true,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-01","alert":"Phishing Block","trigger":"instagramlogin-eta.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"instagramlogin-eta.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"instagramlogin-eta.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-11-01","alert":"Phishing - Instagram","trigger":"instagramlogin-eta.vercel.app","verdict":"phishing","severity":"medium","comment":"Instagram","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-01","alert":"Sinkholed","trigger":"instagramlogin-eta.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null}]}}]}