www.instagram.com - URL scan, 22 Aug 2026
MalwareAnalyzer by Cyble scanned www.instagram.com and returned a unknown verdict (score 8), categorised as credential-harvest. The page resolved to 157.240.8.174 on Facebook, Inc. in AU. The domain was registered 8113 days ago through RegistrarSafe, LLC. 9 domains and 3 IPs were contacted, over 52 HTTP requests. 48 malware samples communicate with this URL (Fromcharcode). This is a point-in-time observation from 22 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score 8) · Confidence 68%
- Scanned URL:
https://www.instagram.com/ - Domain: www.instagram.com · IP: 157.240.8.174 · AS32934 · AU
- Page title: Instagram
- HTTP status: 200 · text/html; charset="utf-8"
- Registrar: RegistrarSafe, LLC · domain age 8113 days · created 2004-06-04
- TLS issuer: C=US, O=DigiCert Inc, CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1 · valid to Aug 30 23: · subject C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.www.instagram.com
- Evidenced operator: Meta Platforms, Inc.
- HTTP requests captured: 52 · cookies set: 5 · outgoing links: 17
- Scan tier: standard · observed 2026-08-22 11:03:13 UTC
Malware communicating with this URL (48)
These samples were observed contacting or being served from www.instagram.com. Each links to its full analysis.
- a5d477490189049fc213532f0a034178ca99721f074cd70131352db1977b084d - referenced ·
a5d477490189049fc213532f0a034178· first seen 2026-08-22 - 18dd751e6246a116f5e07873962d7eda7ad5501e90a4ba6a25dd4bbe74fa87b2 - referenced ·
18dd751e6246a116f5e07873962d7eda· first seen 2026-08-22 - 403c1bf5b95761f2b8e3a257170636b8dbf54a27647bfc5093bbb6ef6c0c037e - referenced ·
403c1bf5b95761f2b8e3a257170636b8· first seen 2026-08-22 - Fromcharcode - referenced ·
3701473332a7fd7b4fafc7b5fa359ee5· first seen 2026-08-22 - bae9939d3d7aa2e72dae1da32c1fd1de88f6bdc117076e129936d84de26d37b3 - referenced ·
bae9939d3d7aa2e72dae1da32c1fd1de· first seen 2026-08-21 - d0daf600fb3d0bfe5e7b81ad19a328dee8eef03b7cc30150727b22282a98b547 - referenced ·
d0daf600fb3d0bfe5e7b81ad19a328de· first seen 2026-08-21 - abda28aee8d5fb52b3304560e45d563844b124598cc6ed6bd7afc11121ed59c0 - referenced ·
abda28aee8d5fb52b3304560e45d5638· first seen 2026-08-21 - 323f57515ae99a880fea43b6c553816c3e99fee5d8d516a0de6843a8ef3f7bce - referenced ·
323f57515ae99a880fea43b6c553816c· first seen 2026-08-21 - d8edfdac34cf6f581a0113ddb9bd10c585b82633f175a9702c3d401e0a34ec65 - referenced ·
d8edfdac34cf6f581a0113ddb9bd10c5· first seen 2026-08-21 - 323579aedef9e4bc13a07906930b296a9b74d2dbf7acf8fc8c54b2a46587729e - referenced ·
323579aedef9e4bc13a07906930b296a· first seen 2026-08-21 - 976a68a6471c486cca780a82d437c74f0127024b40bb47052d487ae1e3130662 - referenced ·
976a68a6471c486cca780a82d437c74f· first seen 2026-08-21 - df0adde3666026c9cd5aa16fc35725e5ffe5243d799a6f31bad08045fb733d47 - referenced ·
df0adde3666026c9cd5aa16fc35725e5· first seen 2026-08-21 - Fromcharcode - referenced ·
05c06067501ee8d6deeb80a58ef04885· first seen 2026-08-20 - ef4daa063f78b2ffcae16a7f01dd0506b58d1c8c76118c13beabe773f2f8f0d5 - referenced ·
ef4daa063f78b2ffcae16a7f01dd0506· first seen 2026-08-20 - 63b5c39c8d25d7adf702d78d31ea768097967eec978db3a8f1a77d141383fd72 - referenced ·
63b5c39c8d25d7adf702d78d31ea7680· first seen 2026-08-20
Antivirus & YARA (1 of 48 engines)
- YARA: delivr.to detections [yara]: DLV_HTML_Smuggling (page content)
These signatures matched text in the page. Pages that quote or document malware can match them, so on their own they do not make a page malicious.
Categories
- credential-harvest
Why this verdict
- Antivirus/YARA detection in page content: DLV_HTML_Smuggling
- Credential-harvesting form
- Valid TLS, no impersonation or off-origin credential post
Contacted infrastructure
- 157.240.8.174 - AS32934 Facebook, Inc. (Australia)
- 157.240.8.52 - AS32934 Facebook, Inc. (Australia)
- 157.240.8.35 - AS32934 Facebook, Inc. (Australia)
Observed indicators
- www.instagram.com
- static.cdninstagram.com
- about.meta.com
- about.instagram.com
- help.instagram.com
- developers.facebook.com
- www.meta.ai
- www.threads.com
- www.facebook.com
- 157.240.8.174
- 157.240.8.52
- 157.240.8.35
- https://www.instagram.com/
- https://static.cdninstagram.com/rsrc.php/yr/r/rzWiSjZRxk5.webp
- https://static.cdninstagram.com/rsrc.php/yj/r/f01UdNyJjJj.webp
- https://static.cdninstagram.com/rsrc.php/yL/r/mMvhX4currF.webp
- https://static.cdninstagram.com/rsrc.php/yY/r/5OCV_xUyQ5h.webp
- https://static.cdninstagram.com/rsrc.php/y9/r/MptwNl-B2pS.webp
- https://static.cdninstagram.com/rsrc.php/yw/r/icwX0xAk0pz.webp
- https://static.cdninstagram.com/rsrc.php/y4/r/QaBlI0OZiks.ico
Other scans of www.instagram.com (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 24 Aug 2026 - suspicious ·
https://onlinebiblecollege.com/ - 24 Aug 2026 - unknown ·
https://gosia-colorist.com/ - 24 Aug 2026 - unknown ·
https://gosia-colorist.com/ - 24 Aug 2026 - unknown ·
http://bascobrunswick.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1613d287b - 24 Aug 2026 - unknown ·
https://5.me/ - 24 Aug 2026 - unknown ·
https://nesimaresort.com/ - 24 Aug 2026 - unknown ·
https://store.edenroc.biz/ - 24 Aug 2026 - unknown ·
https://tallerescarrion.com/uploads/file/43332621506.pdf - 24 Aug 2026 - unknown ·
https://tallerescarrion.com/uploads/file/43332621506.pdf - 24 Aug 2026 - suspicious ·
https://www.mothercare.ro/sites/default/files/webform/resumes/tawapiseligimagawawujimo.pdf
Questions about www.instagram.com
- Is www.instagram.com safe?
- The scan of www.instagram.com on 22 Aug 2026 reached no verdict either way (score 8). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with www.instagram.com?
- 48 analysed samples communicate with this URL, including Fromcharcode.
- How was www.instagram.com checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the standard tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the standard tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of www.instagram.com
Scanned on MalwareAnalyzer by Cyble · Open interactive scan