mass.report
Scan Intelligence Report0/100
low Risk
www.instagram.com
https://www.instagram.com/kalim_shkk?igsh=dzJxeTg1Yjc2aXNr
IP
57.144.74.34 · Meta Platforms Ireland Limited
Location
Ashburn, United States
Domain Age
8034 days
HTTP
200 · 25.9s
SSL
Valid· DigiCert Global G2 TLS RSA SHA256 2020 CA1, DigiCert Inc, US
Status
COMPLETED
Domain Intelligence: instagram.com
Scanned 4 times since Mar 13, 2026, 03:04 PM UTC
ℹ Low (20)
Registered-domain escalation
Submit instagram.com as the primary IOC, enriched with evidence from hostile subdomains like www.instagram.com.
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Technology · 7/19/2026
Summary
The page is hosted on the official Instagram domain (www.instagram.com) and shows an Instagram profile. The screenshot indicates a modal prompting sign-up/login with Instagram branding, not an impersonation. However, the scan evidence reveals extensive API and AJAX activity to Instagram endpoints, which is typical of the real service. No definitive credential harvesting form or phishing UI is observed in the static HTML screenshot provided, and the domain appears legitimate with valid DigiCert certificates and an aged domain. Given the evidence, this appears to be first-party Instagram content rather than impersonation, though the presence of a sign-up modal could be leveraged in abuse scenarios if misused on a clone page, which is not demonstrated here.
Evidence Summary
▸Observed 3 capture stage(s); canonical stage is late_render_3s.
▸POST targets observed during capture: https://www.instagram.com/ajax/qm/?__a=1&__user=0&__comet_req=7&jazoest=22251, https://www.instagram.com/ajax/bz?__a=1&__ccg=UNKNOWN&__comet_req=7&__crn=comet.igweb.PolarisProfileRoute&__d=www&__hs=20608.HYP%3Ainstagram_web_pkg.2.1...0&__hsi=7647500897573943144&__req=3&__rev=1040823603&__s=v0i5yh%3Ao82ijl%3Asnpd2l&__spin_b=trunk&__spin_r=1040823603&__spin_t=1780572556&__user=0&dpr=1&jazoest=22251&lsd=AdS6a2T8IzZdtSOIZuQ31sHnNo4&ph=C3, https://www.instagram.com/api/graphql.
▸Distinctive asset clues: qm, CN__41SBkWQ.js, ZyGaHJUdG8A3mQgfUHD55wSJ8RlPnCWZ8Xgg-tSCw09ZfgQe914iiBfONMKn3YhINqtPbgX2VI-6IU49pVNahkCkQvuWABIjhhRs97xFZK--hBruhBENOpKm_.css, AlrXA0Pno7zUT7ALtx6OCm.css, 586804091_1663503604611279_5923738029581011780_n.jpg, 574462263_17865707319491295_3877321359131458337_n.jpg.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: No
Credential Signals
Forms: 1
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 54
Hosts: 4
Domains: 3
Suspicious Endpoints
hxxps://www[.]instagram[.]com/api/graphql
hxxps://www[.]instagram[.]com/api/v1/users/web_profile_info/?username=kalim_shkk
hxxps://www[.]instagram[.]com/api/v1/web/get_ruling_for_content/?content_type=PROFILE&target_id=74843059294
hxxps://www[.]instagram[.]com/kalim_shkk?igsh=dzJxeTg1Yjc2aXNr
Observed Signals (1)
No explicit credential collection form observed in static HTML
Observed Indicators (0)
No suspicious indicators identified
Risk AssessmentUsed in abuse reports
The scan did not identify phishing indicators such as a credential collection form targeting users or a clone domain impersonating a separate brand. The page appears to be the legitimate Instagram profile interface loaded in a standard browser context, with mixed API interactions typical of a real service. Monitor for unusual behavior such as off-domain credential harvests or unexpected brand impersonation signals, but current evidence supports a first-party Instagram page with normal user onboarding modal elements. Recommend continued observation for any signs of misuse or impersonation on a different domain or cloned page.
Recommended Action
Monitor
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API