{"report_id":"d8879934-60cf-41b6-8556-b4b1da5adc5c","version":6,"status":"done","tags":["instagram","meta","social","phishing","suspicious","telegram_bot"],"date":"2026-04-29T01:51:08Z","url":{"schema":"https","addr":"firdavsjons.github.io/instagram-login/","fqdn":"firdavsjons.github.io","domain":"firdavsjons.github.io","tld":"github.io"},"ip":{"addr":"185.199.109.153","port":0,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"firdavsjons.github.io/instagram-login/","fqdn":"firdavsjons.github.io","domain":"firdavsjons.github.io","tld":"github.io"},"title":"Instagram","dom":{"size":14331,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"25576314a10ae8e7b7463c3da69bb9b8","sha1":"2e42617a0d6cb3f3c957d24778dc4bc383a3ba7f","sha256":"b9968d519533e867690010a330de0034229cf29bd660251adff4c9b14135869b","sha512":"ef9e4f62b5cea1334f41f1398180011280d6a223f1db90c8ee1704905b9be3497c38738d25ccc548d0b79b986426b6757dd137aeefb829616bf197cf7e00baf7","ssdeep":"192:hH1MHuXNo9magjw+WWPwz0hhQjw8BOqsRJm+5x1RZrLRIw404e+Lam04/NyzoFDB:v5HC+hR5LGw40mLam05zo9sho","tlshash":"675294970af308b71903e4b467675609b561c037ee06de647aac479acf96f91c8273cc","dom_hash":"domhashcad81077687c895e693b2f45d8b6eb21","first_seen":"2026-04-29T01:51:09.796755Z","last_seen":"2026-04-29T01:51:09.796755Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"firdavsjons.github.io/instagram-login/","fqdn":"firdavsjons.github.io","domain":"firdavsjons.github.io","tld":"github.io"},"ip":{"addr":"185.199.109.153","port":0,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-03T01:51:08Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":3,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-04-29","alert":"Detects file containing Telegram Bot API","trigger":"firdavsjons.github.io/instagram-login/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-29","alert":"Sinkholed","trigger":"firdavsjons.github.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"firdavsjons.github.io","ip":{"addr":"185.199.111.153","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2013-03-08","domain_rank":0,"first_seen":"2026-04-29T00:18:01.513311Z","last_seen":"2026-04-29T00:18:01.513311Z","alert_count":6,"request_count":2,"received_data":24819,"sent_data":971,"comment":"","tags":null,"fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"GitHub Pages","description":"GitHub Pages is a static site hosting service.","website":"https://pages.github.com/","common_platform_enumeration":"","icon":"GitHub.svg","categories":["PaaS"]},{"name":"Fastly","description":"Fastly is a cloud computing services provider. Fastly's cloud platform provides a content delivery network, Internet security services, load balancing, and video \u0026 streaming services.","website":"https://www.fastly.com","common_platform_enumeration":"","icon":"Fastly.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"static.cdninstagram.com","ip":{"addr":"31.13.72.53","port":443,"asn":32934,"as":"FACEBOOK","country":"Sweden","country_code":"SE"},"domain_registered":"2014-05-01","domain_rank":21477,"first_seen":"2017-02-22T19:40:09Z","last_seen":"2026-04-23T00:02:48.990363Z","alert_count":0,"request_count":3,"received_data":21254,"sent_data":1413,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":[{"url":{"schema":"https","addr":"firdavsjons.github.io/instagram-login/","fqdn":"firdavsjons.github.io","domain":"firdavsjons.github.io","tld":"github.io"},"ip":{"addr":"185.199.111.153","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"md5":"0132398d654474eb1fc293ff4001177a","sha1":"6b114417f655107cf429478389e9f52471051c43","sha256":"b5ab20230e1329fa37d563a02fcfb75dd806f2e687cdb293099666959be42307","sha512":"8a0dcac44d08bb9f494c60f5d6da4a83df8034810e4dbd9c5edff7f786f02762253c1a748dce41c38d0836e502a85c3532e3a5f60884144aa809aab499e088c5","size":5016,"token":"8556077270:AAFv7RAI-8bnGKxiqFNg-OEt0bbUj-aGBz0","is_revoked":false,"bot":{"token":"8556077270:AAFv7RAI-8bnGKxiqFNg-OEt0bbUj-aGBz0","user_id":"8556077270","username":"fishing_firdavs_bot","first_name":"firshing","last_name":"","chat":{"chat_id":"7535826075","title":"","type":"private","bot_is":"member","total_users":2,"active_members":null,"admins":null},"pending_messages":1}}],"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"firdavsjons.github.io/instagram-login/","fqdn":"firdavsjons.github.io","domain":"firdavsjons.github.io","tld":"github.io"},"ip":{"addr":"185.199.111.153","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"0132398d654474eb1fc293ff4001177a","sha1":"6b114417f655107cf429478389e9f52471051c43","sha256":"b5ab20230e1329fa37d563a02fcfb75dd806f2e687cdb293099666959be42307","sha512":"8a0dcac44d08bb9f494c60f5d6da4a83df8034810e4dbd9c5edff7f786f02762253c1a748dce41c38d0836e502a85c3532e3a5f60884144aa809aab499e088c5","ssdeep":"96:nh40p+rMp6tLtcm04/NyQmR7aAoFsSZQIshrGppEymmis6:h404e+Lam04/NyzoFDZhsh0N6","tlshash":"eba153971df708350a67f0ba535b9005b125c03b2e05ef69766c835a6f92ea4883f7ca","size":5016,"data":"","first_seen":"2026-04-29T01:50:40.92358Z","last_seen":"2026-04-29T01:51:09.801222Z","times_seen":2,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-04-29","alert":"Detects file containing Telegram Bot API","trigger":"firdavsjons.github.io/instagram-login/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"firdavsjons.github.io/instagram-login/","fqdn":"firdavsjons.github.io","domain":"firdavsjons.github.io","tld":"github.io"},"ip":{"addr":"185.199.111.153","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-29T01:50:45.871Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.github.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Apr 2026 23:32:36 GMT","end":"Sun, 05 Jul 2026 23:32:35 GMT"},"fingerprint":{"sha1":"18:DE:96:E8:3D:99:B2:8A:0C:D1:0C:48:78:BD:6A:14:6A:05:25:60","sha256":"EA:69:BC:71:1C:B9:D4:56:98:D2:FD:AA:48:54:D7:DC:08:6A:CD:3A:9C:35:01:64:90:9B:68:8A:C7:C0:63:1F"}}},"request":{"raw":"GET /instagram-login/ HTTP/1.1\r\nHost: firdavsjons.github.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: GitHub.com\r\ncontent-type: text/html; charset=utf-8\r\nlast-modified: Tue, 28 Apr 2026 19:38:58 GMT\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31556952\r\netag: W/\"69f10cd2-3824\"\r\nexpires: Wed, 29 Apr 2026 02:00:46 GMT\r\ncache-control: max-age=600\r\ncontent-encoding: gzip\r\nx-proxy-cache: MISS\r\nx-github-request-id: 29BC:27D674:F69DDB3:F8C9F5C:69F163F5\r\naccept-ranges: bytes\r\nage: 0\r\ndate: Wed, 29 Apr 2026 01:50:46 GMT\r\nvia: 1.1 varnish\r\nx-served-by: cache-hel1410027-HEL\r\nx-cache: MISS\r\nx-cache-hits: 0\r\nx-timer: S1777427446.906226,VS0,VE218\r\nvary: Accept-Encoding\r\nx-fastly-request-id: 675c95a49cf9e8afdbc35c9a45937d216b0c7f23\r\ncontent-length: 3934\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"GitHub Pages","description":"GitHub Pages is a static site hosting service.","website":"https://pages.github.com/","common_platform_enumeration":"","icon":"GitHub.svg","categories":["PaaS"]},{"name":"Fastly","description":"Fastly is a cloud computing services provider. Fastly's cloud platform provides a content delivery network, Internet security services, load balancing, and video \u0026 streaming services.","website":"https://www.fastly.com","common_platform_enumeration":"","icon":"Fastly.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14372,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"edaab9198854a9eea38a2c2afc269b1b","sha1":"3c9e2eb851a5d42f004b6edfc45a090a426909ee","sha256":"f0bf127dbf5e022dd3eeb84871c8d356e55072ea700cbec32edf6147cc88afdf","sha512":"9ecce2e1337171bc288bd790ce8c459c24bf4ebce18b198f6cfc8c013d1ca621cbf01470eed308c6c648be6f0b7d24369a02ff498537ee8d1f931714377c828a","ssdeep":"192:zH1LHuXNo9magjw+WWPwz0hhQjw8BOqsRJm+5x1MkrLRIw404e+Lam04/NyzoFDl:xqHC+hMeLGw40mLam05zo9shI","tlshash":"b152a3930af308b72903e4b467675609b561c037ee46ce647aac479acf96f91c8273cc","first_seen":"2026-04-29T01:51:09.797871Z","last_seen":"2026-04-29T01:51:09.797871Z","times_seen":1,"resource_available":false,"data":null}},"time_used":298,"timings":{"blocked":29,"dns":1,"connect":13,"send":0,"wait":232,"receive":1,"ssl":19},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-04-29","alert":"Detects file containing Telegram Bot API","trigger":"firdavsjons.github.io/instagram-login/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-29","alert":"Sinkholed","trigger":"firdavsjons.github.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"static.cdninstagram.com/rsrc.php/v3/yu/r/EHY6QnZYdNX.png","fqdn":"static.cdninstagram.com","domain":"cdninstagram.com","tld":"com"},"ip":{"addr":"31.13.72.53","port":443,"asn":32934,"as":"FACEBOOK","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://firdavsjons.github.io/instagram-login/","date":"2026-04-29T01:50:46.372Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.instagram.com","organization":"Meta Platforms, Inc."},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 05 Feb 2026 00:00:00 GMT","end":"Wed, 06 May 2026 23:59:59 GMT"},"fingerprint":{"sha1":"AB:B1:5A:5E:51:1F:00:75:E8:93:6C:A0:31:4E:CC:AB:93:4B:91:9A","sha256":"C2:96:41:E2:E8:29:78:95:32:74:8D:53:E5:D4:36:5D:BF:1F:F7:3A:91:1D:F1:94:F3:8E:A0:F1:F2:CE:71:9A"}}},"request":{"raw":"GET /rsrc.php/v3/yu/r/EHY6QnZYdNX.png HTTP/1.1\r\nHost: static.cdninstagram.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://firdavsjons.github.io/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\naccess-control-allow-origin: *\r\nlast-modified: Mon, 01 Jan 2001 08:00:00 GMT\r\ncontent-md5: GMg6Ph3avEYo1exT0nCveA==\r\nexpires: Tue, 27 Apr 2027 11:31:00 GMT\r\ncache-control: public,max-age=31536000,immutable\r\nreport-to: {\"max_age\":21600,\"endpoints\":[{\"url\":\"https:\\/\\/www.facebook.com\\/ajax\\/browser_error_reports\\/\"}],\"group\":\"permissions_policy\"}\r\ntiming-allow-origin: *\r\nx-frame-options: DENY\r\ndocument-policy: force-load-at-top, include-js-call-stacks-in-crash-reports\r\npermissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to=\"permissions_policy\"\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nreporting-endpoints: permissions_policy=\"https://www.facebook.com/ajax/browser_error_reports/\"\r\norigin-agent-cluster: ?1\r\nx-fb-debug: k6JkhKzk68D/ACBHdGNueK3OfOXfRObC6dv5hdDifly3+Nk7eeeRtjeDvO1wy/S44tWN4BxHG1o861b4WSqQEg==\r\ncontent-length: 7694\r\ndate: Wed, 29 Apr 2026 01:50:46 GMT\r\nx-fb-connection-quality: EXCELLENT; q=0.9, rtt=7, rtx=0, c=13, mss=1380, tbw=13703, tp=-1, tpl=-1, uplat=2, ullat=-1\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":7694,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 864 x 312, 8-bit colormap, non-interlaced","md5":"18c83a3e1ddabc4628d5ec53d270af78","sha1":"08ad22aaca5acfb57757142e36a9f9ba3631bee4","sha256":"7ad8498fcc83f0cf754e7af0e03b8e73a937514c16ef59d7f20342d1a6d30a4c","sha512":"3158503ca9d1f244671619ec1fea30e4f3dd1551000d9aaecfe9e3f4961aed814ded416abdeae64ca1d54b3e464d1f16b2152ab6aca2baf4ca5688cb537b8f53","ssdeep":"192:d8cERPc9259dz9N67fl7+ZG4ddJ/YxyH0x+5xOKuK:d83Y2Ddzi7flcG4VYemM3uK","tlshash":"39f18fdbfcd1c3b5fa902ef2d4ab08660fe8dcd63f67d35298c112a33a11451aad9419","first_seen":"2023-04-30T19:20:19Z","last_seen":"2026-07-20T04:52:30.041985Z","times_seen":1686,"resource_available":false,"data":null}},"time_used":130,"timings":{"blocked":55,"dns":1,"connect":9,"send":0,"wait":12,"receive":1,"ssl":49},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.cdninstagram.com/rsrc.php/v3/yI/r/VsNE-OHk_8a.png","fqdn":"static.cdninstagram.com","domain":"cdninstagram.com","tld":"com"},"ip":{"addr":"31.13.72.53","port":443,"asn":32934,"as":"FACEBOOK","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://firdavsjons.github.io/instagram-login/","date":"2026-04-29T01:50:46.368Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.instagram.com","organization":"Meta Platforms, Inc."},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 05 Feb 2026 00:00:00 GMT","end":"Wed, 06 May 2026 23:59:59 GMT"},"fingerprint":{"sha1":"AB:B1:5A:5E:51:1F:00:75:E8:93:6C:A0:31:4E:CC:AB:93:4B:91:9A","sha256":"C2:96:41:E2:E8:29:78:95:32:74:8D:53:E5:D4:36:5D:BF:1F:F7:3A:91:1D:F1:94:F3:8E:A0:F1:F2:CE:71:9A"}}},"request":{"raw":"GET /rsrc.php/v3/yI/r/VsNE-OHk_8a.png HTTP/1.1\r\nHost: static.cdninstagram.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://firdavsjons.github.io/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\naccess-control-allow-origin: *\r\nlast-modified: Mon, 01 Jan 2001 08:00:00 GMT\r\ncontent-md5: X93WHDUfZhi3h6+uoEGDGw==\r\nexpires: Fri, 23 Apr 2027 00:21:34 GMT\r\ncache-control: public,max-age=31536000,immutable\r\nreport-to: {\"max_age\":21600,\"endpoints\":[{\"url\":\"https:\\/\\/www.facebook.com\\/ajax\\/browser_error_reports\\/\"}],\"group\":\"permissions_policy\"}\r\ntiming-allow-origin: *\r\nx-frame-options: DENY\r\ndocument-policy: force-load-at-top, include-js-call-stacks-in-crash-reports\r\npermissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to=\"permissions_policy\"\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nreporting-endpoints: permissions_policy=\"https://www.facebook.com/ajax/browser_error_reports/\"\r\norigin-agent-cluster: ?1\r\nx-fb-debug: yRO1e/LQK6yp6rvaYSGFMy3KEw+L2pBM4aApDvi4W2fEKQKN8GxfQFB2pRPKChFyH3+VVTvfBmrB1x+UpjcYLg==\r\ncontent-length: 1772\r\ndate: Wed, 29 Apr 2026 01:50:46 GMT\r\nx-fb-connection-quality: EXCELLENT; q=0.9, rtt=7, rtx=0, c=13, mss=1380, tbw=11595, tp=-1, tpl=-1, uplat=0, ullat=-1\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1772,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit colormap, non-interlaced","md5":"5fddd61c351f6618b787afaea041831b","sha1":"388ddf3c6954dee2dd245aec7bccedf035918b69","sha256":"fdc2ac0085453fedb24be138132b4858add40ec998259ae94fafb9decd459e69","sha512":"16518b4f247f60d58bd6992257f86353f54c70a6256879f42d035f689bed013c2bba59d6ce176ae3565f9585301185bf3889fb46c9ed86050fe3e526252a3e76","ssdeep":"","tlshash":"51311de2c2315d7cfa7032c720188862de93bc6e43836f6b1e5413657d56680eae7924","first_seen":"2023-07-20T20:20:50Z","last_seen":"2026-08-08T07:36:57.914434Z","times_seen":14966,"resource_available":false,"data":null}},"time_used":135,"timings":{"blocked":60,"dns":1,"connect":7,"send":0,"wait":8,"receive":4,"ssl":52},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.cdninstagram.com/rsrc.php/v3/yz/r/c5Rp7Ym-Klz.png","fqdn":"static.cdninstagram.com","domain":"cdninstagram.com","tld":"com"},"ip":{"addr":"31.13.72.53","port":443,"asn":32934,"as":"FACEBOOK","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://firdavsjons.github.io/instagram-login/","date":"2026-04-29T01:50:46.371Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.instagram.com","organization":"Meta Platforms, Inc."},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 05 Feb 2026 00:00:00 GMT","end":"Wed, 06 May 2026 23:59:59 GMT"},"fingerprint":{"sha1":"AB:B1:5A:5E:51:1F:00:75:E8:93:6C:A0:31:4E:CC:AB:93:4B:91:9A","sha256":"C2:96:41:E2:E8:29:78:95:32:74:8D:53:E5:D4:36:5D:BF:1F:F7:3A:91:1D:F1:94:F3:8E:A0:F1:F2:CE:71:9A"}}},"request":{"raw":"GET /rsrc.php/v3/yz/r/c5Rp7Ym-Klz.png HTTP/1.1\r\nHost: static.cdninstagram.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://firdavsjons.github.io/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\naccess-control-allow-origin: *\r\nlast-modified: Mon, 01 Jan 2001 08:00:00 GMT\r\ncontent-md5: /8D8PMcMfnd1qDPcgXbNuw==\r\nexpires: Tue, 27 Apr 2027 23:26:45 GMT\r\ncache-control: public,max-age=31536000,immutable\r\nreport-to: {\"max_age\":21600,\"endpoints\":[{\"url\":\"https:\\/\\/www.facebook.com\\/ajax\\/browser_error_reports\\/\"}],\"group\":\"permissions_policy\"}\r\ntiming-allow-origin: *\r\nx-frame-options: DENY\r\ndocument-policy: force-load-at-top, include-js-call-stacks-in-crash-reports\r\npermissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to=\"permissions_policy\"\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nreporting-endpoints: permissions_policy=\"https://www.facebook.com/ajax/browser_error_reports/\"\r\norigin-agent-cluster: ?1\r\nx-fb-debug: +qGtkNZYYkh4XHly7bXzUCDy/g4AKNkMTEqcN0sMFhP3ov9KZ9eyIQ1x06Ugv99mmcOx+bpck4+d5Ukdl6S3hg==\r\ncontent-length: 5975\r\ndate: Wed, 29 Apr 2026 01:50:46 GMT\r\nx-fb-connection-quality: EXCELLENT; q=0.9, rtt=7, rtx=0, c=13, mss=1380, tbw=4038, tp=-1, tpl=-1, uplat=0, ullat=-1\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":5975,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 564 x 168, 8-bit colormap, non-interlaced","md5":"ffc0fc3cc70c7e7775a833dc8176cdbb","sha1":"08f561d3c63f15c31132c5ba7bba7f6c41e51e44","sha256":"923d80c7ae9a06d102f46b3e47564fa6fadd9a2f3dd3633cc19ac5eeb25bd4ad","sha512":"d34201cd6a3b87f00993cc18a2d2fa51f3883106529768cb26f7e4685ebeab7e58674db096e2407b013b56e3d05b6af9fb6739980150e4486f85c611bcb10289","ssdeep":"96:8WeJkfEVYWXUulVyrwJhUEqr0nh/1Ac5Ojxg4VzzN1TYK4wgacU:nqk0kGyrnEDPGxbPPTYDU","tlshash":"a5c19f5313b6dba49c244051502d60af7876eb274dd970fa395ce29b0f913013779b68","first_seen":"2023-04-30T19:20:19Z","last_seen":"2026-07-20T04:52:30.041255Z","times_seen":4475,"resource_available":false,"data":null}},"time_used":119,"timings":{"blocked":54,"dns":0,"connect":8,"send":0,"wait":8,"receive":1,"ssl":43},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"firdavsjons.github.io/favicon.ico","fqdn":"firdavsjons.github.io","domain":"firdavsjons.github.io","tld":"github.io"},"ip":{"addr":"185.199.111.153","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://firdavsjons.github.io/instagram-login/","date":"2026-04-29T01:50:46.575Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.github.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Apr 2026 23:32:36 GMT","end":"Sun, 05 Jul 2026 23:32:35 GMT"},"fingerprint":{"sha1":"18:DE:96:E8:3D:99:B2:8A:0C:D1:0C:48:78:BD:6A:14:6A:05:25:60","sha256":"EA:69:BC:71:1C:B9:D4:56:98:D2:FD:AA:48:54:D7:DC:08:6A:CD:3A:9C:35:01:64:90:9B:68:8A:C7:C0:63:1F"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: firdavsjons.github.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://firdavsjons.github.io/instagram-login/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: GitHub.com\r\ncontent-type: text/html; charset=utf-8\r\netag: W/\"69f0254f-239b\"\r\ncontent-security-policy: default-src 'none'; style-src 'unsafe-inline'; img-src data:; connect-src 'self'\r\ncontent-encoding: gzip\r\nx-github-request-id: C932:19B3B8:F3679BE:F5933BA:69F163D9\r\naccept-ranges: bytes\r\ndate: Wed, 29 Apr 2026 01:50:46 GMT\r\nvia: 1.1 varnish\r\nage: 28\r\nx-served-by: cache-hel1410027-HEL\r\nx-cache: HIT\r\nx-cache-hits: 1\r\nx-timer: S1777427447.579682,VS0,VE1\r\nvary: Accept-Encoding\r\nx-fastly-request-id: 963d7a86a3539684c82daed20cc1b3eb39d28038\r\ncontent-length: 5142\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"GitHub Pages","description":"GitHub Pages is a static site hosting service.","website":"https://pages.github.com/","common_platform_enumeration":"","icon":"GitHub.svg","categories":["PaaS"]},{"name":"Fastly","description":"Fastly is a cloud computing services provider. Fastly's cloud platform provides a content delivery network, Internet security services, load balancing, and video \u0026 streaming services.","website":"https://www.fastly.com","common_platform_enumeration":"","icon":"Fastly.svg","categories":["CDN"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}],"data":{"size":9115,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (3909)","md5":"1eb970ce5a18bec7165f016df8238566","sha1":"9efd1514af80fe14db4ed28e9bc53975b9ee089c","sha256":"70d613e3acfba24fd2876fcbacaf639e1e111ef4d54baf70761c47673f37d6a3","sha512":"21b4d800cc282ca452f7394e95d5382340ac3481a002c21da681005a44f18ea6cf43959990cd715b4657f180e0e96d6087fe724f3200e909f9fd70ebcd5511bd","ssdeep":"192:Ywnb1iC9OA9XXMa9kukrALQDUnulGVopLAGCALQD6vnglET31iCLL3d:7B8H3DUulGmmv3D6vglETliCfN","tlshash":"e6126d7e19e93308d8028a1539f267993d65880f9e866e6fb5ad0351cf8fe10e1637cc","first_seen":"2023-04-05T03:08:51Z","last_seen":"2026-08-09T10:42:32.459222Z","times_seen":59622,"resource_available":true,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-29","alert":"Sinkholed","trigger":"firdavsjons.github.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Instagram","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Instagram phishing","tags":["instagram","meta","social","phishing"],"meta":null}]}}]}