# PhishDestroy domain threat record: getinstander.net Content language: English Canonical HTML report: https://phishdestroy.io/domain/getinstander.net/ Machine-readable companion: https://phishdestroy.io/domain/getinstander.net/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-21 03:40:31 UTC - Last availability or vendor check: 2026-10-21 23:03:27 UTC - Stored record updated: 2026-10-22 06:21:40 UTC - VirusTotal detections in the stored snapshot: 1/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 188.114.96.3 - Registrar in stored WHOIS data: GoDaddy.com, LLC - Last stored HTTP status: 200 - Registration date (registry RDAP, getinstander.net): 2025-01-28 11:09:38 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a15c8b-0cfb-772a-8ec7-57312754002c/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/getinstander.net - Certificate Transparency search: https://crt.sh/?q=%25.getinstander.net - Web Archive lookup: https://web.archive.org/web/*/https://getinstander.net/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s intake analysis classified the domain as malicious because it distributes a modified Instagram APK, a practice that often involves malware or data‑theft. The site was first seen by PhishDestroy on 2026-10-21, with the recorded page title “Download Instander APK Latest Version 2025 for Android”. An HTTP request to the domain returned a 200 status code at the time of capture and the domain is listed in PhishDestroy’s internal blocklist. How the scam works Attackers host unofficial, modified versions of popular apps and present them as legitimate downloads. By mimicking Instagram’s branding, they aim to convince users to install the APK, which can execute hidden code, exfiltrate credentials, or install additional payloads. The distribution typically bypasses official app stores, increasing the chance of undetected malicious behavior. Evidence VirusTotal’s analysis on 2026-10-20 flagged the domain as phishing once, with Fortinet reporting a malicious label among 92 engines. Google Safe Browsing checked on 2026-10-21 did not flag the site. urlscan captured the page on 2026-10-21 and its machine‑learning engine assigned a malicious score of 74, though its overall verdict was not malicious. OTX listed four pulses referencing the domain as of 2026-10-21, and no external blocklists reported it at that time. Infrastructure The domain was registered on 2025-01-28 through GoDaddy.com, LLC. DNS resolution pointed to 188.114.96.3, a Cloudflare network located in Great Britain, and the site runs behind Cloudflare’s WAF. Site technology fingerprints show WordPress, PHP and common advertising services. What to do Do not download or install the Instander APK from this site; if already installed, remove it and run a reputable mobile security scan. Change any passwords or authentication tokens that may have been entered into the app. Network defenders should block getinstander.net at the firewall or proxy and monitor for any traffic to the recorded IP address. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a15c8b-0cfb-772a-8ec7-57312754002c/ VirusTotal report: https://www.virustotal.com/gui/domain/getinstander.net Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=getinstander.net Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-21 04:16:38 UTC ## Stored page captures - Primary capture: https://i.ibb.co/50VHv5S/7484ba067005.png Captured: 2026-10-21 03:40:31 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a15c8b-0cfb-772a-8ec7-57312754002c.png Captured: 2026-10-21 03:40:31 UTC Source report: https://urlscan.io/result/01a15c8b-0cfb-772a-8ec7-57312754002c/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/d06fc3f4-c746-4844-af50-67318f865bab.png Captured: 2026-10-21 04:13:46 UTC Source report: https://radar.cloudflare.com/scan/d06fc3f4-c746-4844-af50-67318f865bab SHA-256: 9e5c6e394f6476f6c959e7835c95567ca557251770e11fd84e1f2590f0f8b6c4 - URLQuery: https://screenshots.phishdestroy.io/uq/4ed77830-70cc-4008-98b1-856ebe0e35ec.png Source report: https://urlquery.net/report/4ed77830-70cc-4008-98b1-856ebe0e35ec SHA-256: 7c3701129eb06cdd8dde0b059ecc3bf28dc185a0928a6fa0f900560f8b6f996e ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T03:47:03Z", "uuid": "01a15c8b-0cfb-772a-8ec7-57312754002c", "scanned_at": "2026-10-21T03:39:51Z", "final_url": "https://getinstander.net/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://getinstander.net/", "from": "http://getinstander.net/", "status": 307 } ], "ip": "188.114.96.3", "domains": [ "pagead2.googlesyndication.com", "ep2.adtrafficquality.google", "ep1.adtrafficquality.google", "fonts.gstatic.com", "fonts.googleapis.com" ], "ips": [ "2a00:1450:4001:c13::84", "142.251.13.157", "142.250.154.154", "142.251.14.94", "2a00:1450:4001:c21::5f", "142.250.154.157", "188.114.96.3" ], "asns": [ "15169", "13335" ], "countries": [ "DE", "US" ], "link_domains": [ "www.4sync.com", "www.waybackmachinedownloads.com", "archive.org" ], "doc_hash": "7ef3531e76e9a8892fdc01acea56ff9e8ae1cb176b69f9b3afe2d0b27eb6a01e", "script_hashes": [ "bb7a3545bb4ee3695b4cec09c429cc663061c00f44f5304086245ddabf761d39", "d2fb486643e17bd463270885a6afc5a55d7c7e96379c66e94bb22a6769f1905f" ], "globals": [ "_wpemojiSettings", "google_js_reporting_queue", "google_srt", "BGtEY", "google_logging_queue", "ggeac", "google_persistent_state_async", "google_measure_js_timing", "google_tag_data", "google_reactive_ads_global_state", "google_ad_modifications", "adsbygoogle", "google_sa_queue", "google_process_slots", "google_unique_id", "google_rum_task_id_counter", "google_user_agent_client_hint", "google_sa_impl", "googFloatingToolbarManagerAsyncPositionUpdate", "google_global_correlator", "google_prev_clients", "ampInaboxIframes", "ampInaboxPendingMessages", "kadenceConfig", "_____WB$wombat$assign$function_____", "__WB_pmw", "KadenceAccordion", "KadenceBlocksAccordion", "kadence", "GoogleGcLKhOms", "google_image_requests" ], "storage_keys": [ "wpEmojiSettingsSupports", "google_auto_fc_cmp_setting" ], "tls": { "san": [ "*.getinstander.net", "getinstander.net" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "getinstander.net", "protocol": "QUIC", "valid_to": "2026-12-05T05:03:30Z", "valid_from": "2026-09-06T05:03:31Z" }, "domain_age_days": 635, "apex_age_days": 635, "tls_age_days": 44, "tls_valid_days": 89, "requests": 45, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 74, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:16:00Z", "uuid": "d06fc3f4-c746-4844-af50-67318f865bab", "scanned_at": "2026-10-21T04:13:46Z", "final_url": "https://getinstander.net/", "status": 200, "history": [ { "url": "https://getinstander.net/", "status": 200 } ], "dom_hash": "3b4d0a4e75a1f3eaab3f233837d40a9dc2fd20d660deb5fdc9580427cab2af86", "doc_hash": "e9748ccbf18b59c147f3678a716c7061655c08a121fa4cf34d69d6dfbe15dfd3", "domain_risks": [ "Technology", "Shareware/Freeware" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "getinstander.net", "type": "A", "value": "104.21.51.230" }, { "name": "getinstander.net", "type": "A", "value": "172.67.190.160" }, { "name": "getinstander.net", "type": "AAAA", "value": "2606:4700:3031::ac43:bea0" }, { "name": "getinstander.net", "type": "AAAA", "value": "2606:4700:3036::6815:33e6" } ], "dnssec_valid": false, "ip": "104.21.51.230", "whois": { "registrar": "GoDaddy.com, LLC", "created": "2025-01-28T11:09:38Z", "updated": "2026-06-08T13:21:15Z", "expires": "2027-01-28T11:09:38Z", "nameservers": [ "luciane.ns.cloudflare.com", "patrick.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-21T04:13:39Z", "analysis_at": "2026-10-20T15:38:38Z", "stats": { "timeout": 0, "harmless": 54, "malicious": 1, "suspicious": 0, "undetected": 37 }, "detections": { "Fortinet": "phishing" }, "reputation": 0, "created": "2025-01-28T00:00:00Z", "updated": "2026-03-13T00:00:00Z", "first_seen": "2025-01-23T11:27:22Z", "dns": [ { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "luciane.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "patrick.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.190.160" }, { "ttl": 21600, "type": "NS", "value": "luciane.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.21.51.230" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3031::ac43:bea0" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3036::6815:33e6" } ], "dns_at": "2026-10-20T15:38:57Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.getinstander.net", "getinstander.net" ], "issuer": "Let's Encrypt / YE1", "serial": "56b9c25001c1954ab8b9ac9c97c410db536", "sha256": "837c8ab23263995f51d84587c47f08396944c1c3a5180c1740dca5c40dec2790", "subject": "getinstander.net", "valid_to": "2026-12-05T05:03:30Z", "valid_from": "2026-09-06T05:03:31Z" }, "rdap": { "status": [ "client delete prohibited", "client renew prohibited", "client transfer prohibited", "client update prohibited" ], "events": { "expiration": "2027-01-28T11:09:38Z", "last changed": "2026-06-08T13:21:15Z", "registration": "2025-01-28T11:09:38Z", "last update of RDAP database": "2026-10-20T12:37:20Z" }, "registrar": "GoDaddy.com, LLC", "registrar_iana_id": "146" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-21T04:16:23Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "getinstander.net" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-21T03:43:15Z", "first": "2025-02-02T19:25:20Z", "changes": 21, "days_archived": 25, "scans_per_day": 0.04, "avg_page_bytes": -223908516 }, "robots_txt": { "present": true, "sitemaps": [ "http://getinstander.net/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 7 }, "social_tags": { "ogUrl": "http://getinstander.net/", "title": "Download Instander APK Latest Version 2025 for Android", "ogType": "website", "robots": "follow, index, max-snippet:-1, max-video-preview:-1, max-image-preview:large", "ogTitle": "Download Instander APK Latest Version 2025 for Android", "generator": "WordPress 6.7.2", "ogSiteName": "Lightroom APKs", "description": "Instander APK is one of the best Mod APKs of Instagram, which offers many additional features unavailable on the official app.", "twitterCard": "summary_large_image", "twitterSite": "@shoaibghafar", "canonicalUrl": "https://getinstander.net", "ogDescription": "Instander APK is one of the best Mod APKs of Instagram, which offers many additional features unavailable on the official app.", "twitterCreator": "@shoaibghafar" }, "trackers": { "requests": 31, "trackers": [ { "name": "Google Marketing Platform", "company": "Google", "country": "US", "category": "Advertising", "requests": 4 }, { "name": "Google Syndication", "company": "Google", "country": "US", "category": "Advertising", "requests": 5 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 } ] }, "mixed_content": { "no_sri": [ "https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js" ], "third_party_scripts": 1 }, "status": { "up": true, "code": 200, "timings": { "dns": 2, "tls": 51, "wait": 6534, "connect": 7, "download": 649 }, "response_ms": 7243 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 224610, "co2_grams": 0.0082, "cleaner_than": 4 }, "dns_server": { "ns": [ { "ip": "108.162.194.120", "host": "luciane.ns.cloudflare.com" }, { "ip": "108.162.195.200", "host": "patrick.ns.cloudflare.com" } ], "zone": "getinstander.net" }, "location": { "ip": "2a06:98c1:3120::9", "asn": "13335", "org": "CloudFLARENET-EU", "city": "London", "country": "GB" }, "ssl": { "issuer": "Let's Encrypt / YE1", "subject": "getinstander.net" }, "dns": { "A": [ "188.114.97.9", "188.114.96.9" ], "NS": [ "patrick.ns.cloudflare.com", "luciane.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"luciane.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2415940683, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2a06:98c1:3121::9", "2a06:98c1:3120::9" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2a06:98c1:3121::9", "family": 6 }, "redirects": { "chain": [ "https://getinstander.net" ] }, "subdomains": { "count": 12, "subdomains": [ "apk.getinstander.net", "autoconfig.getinstander.net", "autodiscover.getinstander.net", "cpanel.getinstander.net", "cpcalendars.getinstander.net", "cpcontacts.getinstander.net", "mail.getinstander.net", "webdisk.getinstander.net", "webmail.getinstander.net", "whm.getinstander.net", "www.apk.getinstander.net", "www.getinstander.net" ] }, "tech_stack": { "technologies": [ "WordPress", "MySQL", "PHP", "Kadence WP Kadence", "RankMath SEO", "Google AdSense", "Priority Hints", "Google Font API", "Cloudflare", "Open Graph", "HTTP/3" ] }, "social_presence": { "profiles": [ "https://x.com/shoaibghafar" ] }, "linked_pages": { "external": [ "https://www.4sync.com/web/directDownload/XbQhZLeF/gkOsXdx3.c2a2736e9b5f02bf922eb23d3230f0b0", "https://www.waybackmachinedownloads.com/", "https://archive.org/" ], "external_count": 3, "internal_count": 8 }, "whois": { "registrar": "GoDaddy.com, LLC", "created": "2025-01-28T11:09:38Z", "updated": "2026-06-08T13:21:15Z", "expires": "2027-01-28T11:09:38Z", "status": [ "clientDeleteProhibited https://icann.org/epp", "clientRenewProhibited https://icann.org/epp", "clientTransferProhibited https://icann.org/epp", "clientUpdateProhibited https://icann.org/epp" ], "nameservers": [ "luciane.ns.cloudflare.com", "patrick.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html" } } } } ```