www.instagram.com - malicious URL scan, 22 Aug 2026
MalwareAnalyzer by Cyble scanned www.instagram.com and returned a malicious verdict (score 68), categorised as credential-harvest. The page resolved to 157.240.8.174 on Facebook, Inc. in AU. The domain was registered 8113 days ago through RegistrarSafe, LLC. 9 domains and 3 IPs were contacted, over 52 HTTP requests. 45 malware samples communicate with this URL (Fromcharcode). This is a point-in-time observation from 22 Aug 2026; the page may have changed since.
Scan result
- Verdict: malicious (score 68) · Confidence 77%
- Scanned URL:
https://www.instagram.com/ - Domain: www.instagram.com · IP: 157.240.8.174 · AS32934 · AU
- Page title: Instagram
- HTTP status: 200 · text/html; charset="utf-8"
- Registrar: RegistrarSafe, LLC · domain age 8113 days · created 2004-06-04
- HTTP requests captured: 52 · cookies set: 5 · outgoing links: 17
- Scan tier: standard · observed 2026-08-22 03:09:09 UTC
Malware communicating with this URL (45)
These samples were observed contacting or being served from www.instagram.com. Each links to its full analysis.
- Fromcharcode - referenced ·
3701473332a7fd7b4fafc7b5fa359ee5· first seen 2026-08-22 - bae9939d3d7aa2e72dae1da32c1fd1de88f6bdc117076e129936d84de26d37b3 - referenced ·
bae9939d3d7aa2e72dae1da32c1fd1de· first seen 2026-08-21 - d0daf600fb3d0bfe5e7b81ad19a328dee8eef03b7cc30150727b22282a98b547 - referenced ·
d0daf600fb3d0bfe5e7b81ad19a328de· first seen 2026-08-21 - abda28aee8d5fb52b3304560e45d563844b124598cc6ed6bd7afc11121ed59c0 - referenced ·
abda28aee8d5fb52b3304560e45d5638· first seen 2026-08-21 - 323f57515ae99a880fea43b6c553816c3e99fee5d8d516a0de6843a8ef3f7bce - referenced ·
323f57515ae99a880fea43b6c553816c· first seen 2026-08-21 - d8edfdac34cf6f581a0113ddb9bd10c585b82633f175a9702c3d401e0a34ec65 - referenced ·
d8edfdac34cf6f581a0113ddb9bd10c5· first seen 2026-08-21 - 323579aedef9e4bc13a07906930b296a9b74d2dbf7acf8fc8c54b2a46587729e - referenced ·
323579aedef9e4bc13a07906930b296a· first seen 2026-08-21 - 976a68a6471c486cca780a82d437c74f0127024b40bb47052d487ae1e3130662 - referenced ·
976a68a6471c486cca780a82d437c74f· first seen 2026-08-21 - df0adde3666026c9cd5aa16fc35725e5ffe5243d799a6f31bad08045fb733d47 - referenced ·
df0adde3666026c9cd5aa16fc35725e5· first seen 2026-08-21 - Fromcharcode - referenced ·
05c06067501ee8d6deeb80a58ef04885· first seen 2026-08-20 - ef4daa063f78b2ffcae16a7f01dd0506b58d1c8c76118c13beabe773f2f8f0d5 - referenced ·
ef4daa063f78b2ffcae16a7f01dd0506· first seen 2026-08-20 - 63b5c39c8d25d7adf702d78d31ea768097967eec978db3a8f1a77d141383fd72 - referenced ·
63b5c39c8d25d7adf702d78d31ea7680· first seen 2026-08-20 - 29801844242682134cdbe875d3caf647c4a752e833e0993d3f6c3a748566ab39 - referenced ·
29801844242682134cdbe875d3caf647· first seen 2026-08-20 - 5eb6f3d81081997ecb17f86f50073304fee03c9eb2ccd0ae5fc113abad0233e0 - referenced ·
5eb6f3d81081997ecb17f86f50073304· first seen 2026-08-20 - 3e45dd6f1e5cd1cebed108e753617320eef7f051f37ee33c6b166719088a1b6a - referenced ·
3e45dd6f1e5cd1cebed108e753617320· first seen 2026-08-19
Antivirus & YARA (1 of 48 engines)
- YARA: delivr.to detections [yara]: DLV_HTML_Smuggling (page content)
Categories
- credential-harvest
Why this verdict
- Antivirus/YARA detection in page content: DLV_HTML_Smuggling
- Credential-harvesting form
- Matches phishing-kit family "Meta / Facebook Login Kit"
Contacted infrastructure
- 157.240.8.174 - AS32934 Facebook, Inc. (Australia)
- 157.240.8.52 - AS32934 Facebook, Inc. (Australia)
- 157.240.8.35 - AS32934 Facebook, Inc. (Australia)
Observed indicators
- www.instagram.com
- static.cdninstagram.com
- about.meta.com
- about.instagram.com
- help.instagram.com
- developers.facebook.com
- www.meta.ai
- www.threads.com
- www.facebook.com
- 157.240.8.174
- 157.240.8.52
- 157.240.8.35
- https://www.instagram.com/
- https://static.cdninstagram.com/rsrc.php/yr/r/rzWiSjZRxk5.webp
- https://static.cdninstagram.com/rsrc.php/yj/r/f01UdNyJjJj.webp
- https://static.cdninstagram.com/rsrc.php/yL/r/mMvhX4currF.webp
- https://static.cdninstagram.com/rsrc.php/yY/r/5OCV_xUyQ5h.webp
- https://static.cdninstagram.com/rsrc.php/y9/r/MptwNl-B2pS.webp
- https://static.cdninstagram.com/rsrc.php/yw/r/icwX0xAk0pz.webp
- https://static.cdninstagram.com/rsrc.php/y4/r/QaBlI0OZiks.ico
Other scans of www.instagram.com (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 24 Aug 2026 - unknown ·
https://tachikawa-derma.biz/ckfinder/userfiles/files/77335507874.pdf - 24 Aug 2026 - unknown ·
https://tachikawa-derma.biz/ckfinder/userfiles/files/77335507874.pdf - 24 Aug 2026 - unknown ·
http://eng.sut.ac.th/tce/2016/administrator/ckfinder/userfiles/files/49307295506.pdf - 24 Aug 2026 - unknown ·
http://eng.sut.ac.th/tce/2016/administrator/ckfinder/userfiles/files/49307295506.pdf - 24 Aug 2026 - unknown ·
https://progleasing.com/en/ - 24 Aug 2026 - unknown ·
http://serge-valentin.net/ckfinder/userfiles/files/vatigewuv.pdf - 24 Aug 2026 - unknown ·
http://serge-valentin.net/ckfinder/userfiles/files/vatigewuv.pdf - 24 Aug 2026 - unknown ·
https://au.norton.com/ - 24 Aug 2026 - unknown ·
https://au.norton.com/ - 24 Aug 2026 - unknown ·
https://www.lsv-wittlage.de/ckfinder/userfiles/files/rigefivijafiziw.pdf
Questions about www.instagram.com
- Is www.instagram.com safe?
- No. MalwareAnalyzer scanned www.instagram.com on 22 Aug 2026 and returned a malicious verdict with a score of 68 out of 100, categorised as credential-harvest. Treat it as hostile until it is re-checked.
- What malware is associated with www.instagram.com?
- 45 analysed samples communicate with this URL, including Fromcharcode.
- How was www.instagram.com checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the standard tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the standard tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of www.instagram.com
Scanned on MalwareAnalyzer by Cyble · Open interactive scan