mass.report
Scan Intelligence Report0/100
medium Risk
www.instagram.com
https://www.instagram.com/dadyless_chulli?igsh=MTJqeTBrMzFqM3c3bg==
IP
31.13.66.174 · Facebook, Inc
Location
Ashburn, United States
Domain Age
8046 days
HTTP
200 · 23.2s
SSL
Valid· DigiCert Global G2 TLS RSA SHA256 2020 CA1, DigiCert Inc, US
Status
COMPLETED
Domain Intelligence: instagram.com
Scanned 4 times since Mar 13, 2026, 03:04 PM UTC
ℹ Low (20)
Registered-domain escalation
Submit instagram.com as the primary IOC, enriched with evidence from hostile subdomains like www.instagram.com.
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Social Media · 7/19/2026
Summary
The page presents Instagram branding and content on the domain www.instagram.com with an official-looking UI. The screenshot shows a modal-like UI that resembles legitimate Instagram sign-up prompts. However, the URL points to an Instagram profile (dadyless_chulli) and the content appears to be the authentic Instagram surface rather than a credential-grabbing impersonation. The presence of numerous legitimate Instagram endpoints in the network log and the valid DigiCert certificate for *.www.instagram.com further support first-party behavior. No explicit credential harvesting form was found in the static HTML, and the observed login-related assets appear to be part of the standard Instagram frontend. Given the evidence, this aligns with first-party Instagram content rather than a phishing impersonation at this time.
Evidence Summary
▸Observed 3 capture stage(s); canonical stage is late_render_3s.
▸POST targets observed during capture: https://www.instagram.com/ajax/qm/?__a=1&__user=0&__comet_req=7&jazoest=22405, https://www.instagram.com/ajax/bz?__a=1&__ccg=UNKNOWN&__comet_req=7&__crn=comet.igweb.PolarisProfileRoute&__d=www&__hs=20620.HYP%3Ainstagram_web_pkg.2.1...0&__hsi=7651914414161837497&__req=3&__rev=1041539466&__s=7ajozb%3Ag6deeu%3Afqgif3&__spin_b=trunk&__spin_r=1041539466&__spin_t=1781600158&__user=0&dpr=1&jazoest=22405&lsd=AdTy1uxkvKPRAqtAF-FUtOHxPzE&ph=C3, https://www.instagram.com/api/graphql.
▸Distinctive asset clues: qm, kT5QmI5DcXU0B2qWghXmjkGf4mtTXftG8VA9yiwOeigAXi6rgVsZi9DknWgrQeM8RAqa_uc6NUYb59f5OOy-5gC265F8VQprIY2Cnh2oY742RzSepHUSZ1-_rZDsTdk1Pt9HRtKQGwG0ihEped9BMUsuFZ-Qx8lcabVTDOwgx-s7CoHnQnje6_FjE3qJZCcc2ZP1MqPq1CQXzSCfvim_u89BurP8onn-JtdZ7PJA64HI349fK4TMMsiJC02ezAdmh5DEndjkxZ52GvD7uzDKeHWrECl3_n2Jc9FVqcd252S-KrBJoNkaJwFT836lxJeP1HIUYBqZ4h.js, RBPlpq8XBEr3mQgfUHD55w7WHFQHmEkK4Xgg-tSCw09ZW6r8VFgkEaVfgQe914iiBfONMKn3YhINqtPbgX2VI-6IU49pVNahkCkQvuWABIjhhRs97xFZK--hBruhBENOpKm_.css, k9nOd3POwRJj3ESvcu_VsS.css, 573323465_1219825463302212_7278921664109726296_n.png.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: No
Credential Signals
Forms: 1
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 51
Hosts: 4
Domains: 4
Suspicious Endpoints
hxxps://www[.]instagram[.]com/api/graphql
hxxps://www[.]instagram[.]com/api/v1/users/web_profile_info/?username=dadyless_chulli
hxxps://www[.]instagram[.]com/api/v1/web/get_ruling_for_content/?content_type=PROFILE&target_id=30332992516
hxxps://www[.]instagram[.]com/api/v1/discover/ayml/
hxxps://www[.]instagram[.]com/accounts/login/?next=/api/v1/discover/ayml/
hxxps://www[.]instagram[.]com/dadyless_chulli?igsh=MTJqeTBrMzFqM3c3bg%3D%3D
Attack Techniques (4)
Branded social media UI (Instagram) loaded from official domainSPA-style dynamic content with external script bundles and API callsOAuth/login-like prompts embedded in a legitimate user flow on official domainSSL certificate issued to *.www.instagram.com (Meta Platforms, Inc.)
Indicators of Compromise (7)
▸Hostname: www.instagram.com
▸Page Title: (@dadyless_chulli) • Instagram photos and videos
▸SSL Subject: *.www.instagram.com, www.instagram.com (Meta Platforms, Inc.)
▸API endpoints listed include https://www.instagram.com/api/graphql and https://www.instagram.com/api/v1/...
▸Network requests include standard Instagram assets and scripts from static.cdninstagram.com
▸WHOIS shows long domain age with official registrar-like info; IP resolved to Facebook, Inc.
▸Final URL preserves Instagram path and user handle
Risk AssessmentUsed in abuse reports
The scan indicates the page is served by Instagram itself with legitimate branding and network activity to Instagram APIs. No definitive credential collection form or data exfiltration target was observed in the static HTML; the modal UI appears to be part of the legitimate Instagram onboarding or profile viewing experience rather than a credential phishing page. While the screenshot shows a sign-up modal, it is consistent with standard Instagram UX on the official domain. Monitor for anomalous redirects or off-domain assets in future scans, but current evidence does not confirm phishing or abuse beyond normal social-media platform behavior.
Recommended Action
Monitor
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API