# PhishDestroy domain threat record: instander-hq.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/instander-hq.com/ Machine-readable companion: https://phishdestroy.io/domain/instander-hq.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-25 16:48:40 UTC - Last availability or vendor check: 2026-10-25 16:48:40 UTC - Stored record updated: 2026-10-25 20:49:51 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 84.32.84.215 - Registrar in stored WHOIS data: Atak Domain - Registrar country in stored WHOIS data: IN - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-02-02 05:05:32 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a173f4-e55d-7369-aa58-ee2964b1584b/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/instander-hq.com - Certificate Transparency search: https://crt.sh/?q=%25.instander-hq.com - Web Archive lookup: https://web.archive.org/web/*/https://instander-hq.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s intake AI classified the site as malicious because it advertises an “Instander APK” that purports to be an enhanced Instagram client. The recorded page title reads “Instander APK Download Official Latest Version (2026)” and the page excerpt lists features such as ad‑free browsing, Ghost Mode and uncompressed media downloads. The domain was first seen by PhishDestroy on 2026-10-25 and returned an HTTP 200 response on that date. How the scam works Fraudulent mod‑APK sites distribute unofficial versions of popular apps, often bundling malware or spyware that can capture credentials, location data or install unwanted software. By claiming added features like ad‑free use or privacy modes, they entice users to download and install the file, exposing the device to potential compromise. Evidence VirusTotal scanned the domain on 2026-09-30 with 92 engines and reported zero detections. Google Safe Browsing checked on 2026-10-25 and did not flag the site. OTX listed three pulses referencing the domain as of 2026-10-25. urlscan.io’s engine analysis on 2026-10-25 marked the URL as malicious with a score of 98, though its overall verdict was non‑malicious; PhishDestroy’s internal blocklist also contains the domain, while external blocklists reported none. Infrastructure The domain was registered on 2026-02-02 through Atak Domain Bilgi Teknolojileri A.S., giving it an age of 265 days at the time of detection. Hosting records show the site served from an IP in the Hostinger International Limited network (84.32.84.215) and used a Let’s Encrypt TLS certificate valid from 2026-09-30 to 2026-12-29. No additional infrastructure details were linked to the malicious assessment. What to do Do not download or install the APK from this site; if already installed, remove it and run a reputable mobile security scan. Organizations should block the domain at the DNS or proxy level and monitor for any outbound connections to the recorded IP addresses. Users who may have entered credentials should change those passwords and review account activity for unauthorized access. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a173f4-e55d-7369-aa58-ee2964b1584b/ Cloudflare Radar report: https://radar.cloudflare.com/scan/6f7712a2-0347-40cc-ac4e-9e9393a91ad6 URLQuery report: https://urlquery.net/report/8f299b33-7bc2-4103-b948-deece87efc3d Stored capture screenshot: https://i.ibb.co/B2MGddtj/e913c27217ab.png Cloudflare Radar screenshot (2026-10-25T17:19:51Z): https://screenshots.phishdestroy.io/cf/6f7712a2-0347-40cc-ac4e-9e9393a91ad6.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/8f299b33-7bc2-4103-b948-deece87efc3d.png URLScan screenshot (2026-10-25T16:52:48Z): https://screenshots.phishdestroy.io/us/01a173fa-72a0-701e-a0a4-c75f6ee5ff2f.png URLScan capture report: https://urlscan.io/result/01a173fa-72a0-701e-a0a4-c75f6ee5ff2f/ VirusTotal report: https://www.virustotal.com/gui/domain/instander-hq.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=instander-hq.com Archived copy: https://web.archive.org/web/20261025164914/https://instander-hq.com/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-25 17:22:36 UTC ## Stored page captures - Primary capture: https://i.ibb.co/B2MGddtj/e913c27217ab.png Captured: 2026-10-25 16:48:40 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a173f4-e55d-7369-aa58-ee2964b1584b.png Captured: 2026-10-25 16:48:40 UTC Source report: https://urlscan.io/result/01a173f4-e55d-7369-aa58-ee2964b1584b/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/6f7712a2-0347-40cc-ac4e-9e9393a91ad6.png Captured: 2026-10-25 17:19:51 UTC Source report: https://radar.cloudflare.com/scan/6f7712a2-0347-40cc-ac4e-9e9393a91ad6 SHA-256: 89747da6bc883f8f94bf403e93e2299d2a701d9a569b0a77e5db319bcfc57c97 - URLQuery: https://screenshots.phishdestroy.io/uq/8f299b33-7bc2-4103-b948-deece87efc3d.png Source report: https://urlquery.net/report/8f299b33-7bc2-4103-b948-deece87efc3d SHA-256: f728eebd48ee0a56788fbd22db0a73f8d11c3c856c144678c9ffc8ef56391e24 - URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a173fa-72a0-701e-a0a4-c75f6ee5ff2f.png Captured: 2026-10-25 16:52:48 UTC Source report: https://urlscan.io/result/01a173fa-72a0-701e-a0a4-c75f6ee5ff2f/ SHA-256: 3ce7650f70788c371dc3024a73f9d027d214ce149f6c113e5c2004bcb7f64099 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-25T17:21:50Z", "uuid": "01a173f4-e55d-7369-aa58-ee2964b1584b", "scanned_at": "2026-10-25T16:46:43Z", "final_url": "https://instander-hq.com/", "status": 200, "ip": "92.113.16.190", "domains": [ "www.youtube.com", "jnn-pa.googleapis.com", "googleads.g.doubleclick.net", "fonts.gstatic.com", "challenges.cloudflare.com", "cdn.tailwindcss.com", "region1.google-analytics.com", "i.ytimg.com", "www.googletagmanager.com", "www.google.com", "static.doubleclick.net" ], "ips": [ "216.239.34.36", "172.217.112.4", "192.178.183.119", "142.251.14.97", "142.251.153.119", "192.178.183.148", "192.178.183.157", "142.251.20.94", "142.251.155.4", "104.18.94.41", "172.67.68.11", "92.113.16.190" ], "asns": [ "15169", "13335", "47583" ], "countries": [ "US", "DE" ], "doc_hash": "9888d3bd39548ac0a5dab12f314acb98f1f918a911c867c23397111c140b4cef", "globals": [ "tailwind", "turnstile", "uiModule", "downloadModule", "aiModule", "/template.html", "dataLayer", "google_tag_data", "google_tag_manager", "onYouTubeIframeAPIReady", "gaGlobal" ], "cookies": [ "__Secure-YNID", "YSC", "VISITOR_INFO1_LIVE", "VISITOR_PRIVACY_METADATA", "__Secure-ROLLOUT_TOKEN", "_ga_B4TW56WVSN", "_ga" ], "tls": { "san": [ "instander-hq.com", "www.instander-hq.com" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "instander-hq.com", "protocol": "TLS 1.3", "valid_to": "2026-12-29T02:07:41Z", "valid_from": "2026-09-30T02:07:42Z" }, "domain_age_days": 265, "apex_age_days": 265, "tls_age_days": 25, "tls_valid_days": 89, "requests": 22, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 98, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "hcdn", "content-type": "text/html; charset=UTF-8", "strict-transport-security": "max-age=31536000; includeSubDomains; preload", "content-security-policy": "upgrade-insecure-requests", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-25T17:21:52Z", "uuid": "6f7712a2-0347-40cc-ac4e-9e9393a91ad6", "scanned_at": "2026-10-25T17:19:51Z", "final_url": "https://instander-hq.com/", "status": 200, "history": [ { "url": "https://instander-hq.com/", "status": 200 } ], "dom_hash": "688cf97c7f2f07f6a2579d48a2344204da6ef7466267bf51479c082c822f4f7c", "doc_hash": "9888d3bd39548ac0a5dab12f314acb98f1f918a911c867c23397111c140b4cef", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "instander-hq.com", "type": "A", "value": "2.57.91.223" }, { "name": "instander-hq.com", "type": "A", "value": "84.32.84.167" }, { "name": "instander-hq.com", "type": "AAAA", "value": "2a02:4780:84:9e31:2492:c6d9:373c:e85f" }, { "name": "instander-hq.com", "type": "AAAA", "value": "2a02:4780:84:ba73:7508:4c:fa0b:c0a9" } ], "dnssec_valid": false, "ip": "2.57.91.223", "whois": { "registrar": "Atak Domain Bilgi Teknolojileri A.S.", "created": "2026-02-02T06:05:32Z", "updated": "2026-10-04T11:10:37Z", "expires": "2027-02-02T06:05:32Z", "nameservers": [ "aurora.dns-parking.com", "nebula.dns-parking.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-25T17:19:24Z", "analysis_at": "2026-09-30T06:48:21Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 0, "undetected": 37 }, "reputation": 0, "created": "2026-02-02T00:00:00Z", "updated": "2026-02-02T00:00:00Z", "first_seen": "2026-02-02T06:32:53Z", "dns": [ { "ttl": 14400, "type": "MX", "value": "mx1.hostinger.com", "priority": 5 }, { "ttl": 21600, "type": "NS", "value": "nebula.dns-parking.com" }, { "ttl": 60, "type": "AAAA", "value": "2a02:4780:4e:5163:2f2d:fef7:a91d:320f" }, { "ttl": 60, "type": "A", "value": "147.79.120.30" }, { "ttl": 3600, "type": "SOA", "rname": "dns.hostinger.com", "value": "aurora.dns-parking.com" }, { "ttl": 60, "type": "A", "value": "148.135.128.245" }, { "ttl": 21600, "type": "NS", "value": "aurora.dns-parking.com" }, { "ttl": 14400, "type": "MX", "value": "mx2.hostinger.com", "priority": 10 }, { "ttl": 60, "type": "AAAA", "value": "2a02:4780:51:f328:55ee:30e2:7d5d:b66e" }, { "ttl": 3600, "type": "TXT", "value": "v=spf1 include:_spf.mail.hostinger.com ~all" } ], "dns_at": "2026-09-30T06:54:01Z", "jarm": "27d40d40d00040d00042d43d000000e1ea2a807a629b496b664cf07ad7c08d", "cert": { "san": [ "instander-hq.com", "www.instander-hq.com" ], "issuer": "Let's Encrypt / YE1", "serial": "6d5f57ddd991ea959ffe129b374174b1df3", "sha256": "7678c44e04abb4326bfe773fe215cd6047d3c1931733df47674c737468f6da1c", "subject": "instander-hq.com", "valid_to": "2026-12-29T02:07:41Z", "valid_from": "2026-09-30T02:07:42Z" }, "whois": [], "rdap": { "status": [ "client transfer prohibited" ], "events": { "expiration": "2027-02-02T09:05:32Z", "last changed": "2026-09-08T23:36:32Z", "registration": "2026-02-02T06:05:32Z", "registrar expiration": "2027-02-02T09:05:32Z", "last update of RDAP database": "1-01-01T00:00:00Z" }, "registrar": "Atak Domain", "registrar_iana_id": "1601" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-25T17:22:07Z", "mail_config": { "mx": [ "mx2.hostinger.com", "mx1.hostinger.com" ], "spf": "v=spf1 include:_spf.mail.hostinger.com ~all", "dkim": [ "hostingermail-a" ], "dmarc": true, "dkim_bits": 2048, "spf_lookups": 3 }, "caa_records": { "domain": "instander-hq.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-25T16:49:14Z", "first": "2026-08-05T07:50:55Z", "changes": 1, "days_archived": 2, "scans_per_day": 0.01, "avg_page_bytes": 28287 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://instander-hq.com/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 1 }, "social_tags": { "ogUrl": "https://instander-hq.com/", "title": "Instander APK Download Official Latest Version (2026)", "ogType": "website", "ogImage": "https://instander-hq.com/apple-touch-icon.png", "ogTitle": "Instander APK Download Official Latest Version (2026)", "ogSiteName": "Instander HQ", "themeColor": "#d6249f", "description": "Download Instander APK v19.1 for Android. Experience 100% ad-free scrolling, Ghost Mode, and original uncompressed media downloads. Clean, VirusTotal verified.", "twitterCard": "summary", "canonicalUrl": "https://instander-hq.com/", "ogDescription": "Download Instander APK v19.1 for Android. Experience 100% ad-free scrolling, Ghost Mode, and original uncompressed media downloads. Clean, VirusTotal verified." }, "trackers": { "requests": 19, "trackers": [ { "name": "Google", "company": "Google", "country": "US", "category": "Advertising", "requests": 1 }, { "name": "Google Marketing Platform", "company": "Google", "country": "US", "category": "Advertising", "requests": 3 }, { "name": "YouTube", "company": "Google", "country": "US", "category": "Audio/Video Player", "requests": 8 }, { "name": "Cloudflare", "company": "Cloudflare", "country": "US", "category": "Hosting", "requests": 2 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 2 } ] }, "mixed_content": { "no_sri": [ "https://cdn.tailwindcss.com/", "https://challenges.cloudflare.com/turnstile/v0/api.js" ], "upgrade_insecure": true, "third_party_scripts": 2 }, "status": { "up": true, "code": 200, "timings": { "dns": 55, "tls": 59, "wait": 140, "connect": 7, "download": 11 }, "response_ms": 272 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443 ] }, "carbon": { "bytes": 109686, "co2_grams": 0.004, "cleaner_than": 20 }, "dns_server": { "ns": [ { "ip": "172.64.52.197", "host": "aurora.dns-parking.com" }, { "ip": "172.64.53.231", "host": "nebula.dns-parking.com" } ], "zone": "instander-hq.com" }, "cookies": { "cookies": [ { "name": "__Secure-YNID", "secure": true, "http_only": true, "same_site": "None" }, { "name": "YSC", "secure": true, "session": true, "http_only": true, "same_site": "None" }, { "name": "VISITOR_INFO1_LIVE", "secure": true, "http_only": true, "same_site": "None" }, { "name": "VISITOR_PRIVACY_METADATA", "secure": true, "http_only": true, "same_site": "None" }, { "name": "__Secure-ROLLOUT_TOKEN", "secure": true, "http_only": true, "same_site": "None" }, { "name": "_ga_B4TW56WVSN" }, { "name": "_ga" } ] }, "location": { "ip": "2a02:4780:45:2e13:d659:439:ae84:3882", "asn": "47583", "org": "Hostinger International Limited", "city": "Frankfurt am Main", "country": "DE" }, "ssl": { "issuer": "Let's Encrypt / YE1", "subject": "instander-hq.com" }, "dns": { "A": [ "92.113.16.174", "92.113.23.214" ], "MX": [ "{\"exchange\": \"mx1.hostinger.com\", \"priority\": 5}", "{\"exchange\": \"mx2.hostinger.com\", \"priority\": 10}" ], "NS": [ "nebula.dns-parking.com", "aurora.dns-parking.com" ], "SOA": "{\"nsname\": \"aurora.dns-parking.com\", \"hostmaster\": \"dns.hostinger.com\", \"serial\": 2026102201, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 600}", "TXT": [ "v=spf1 include:_spf.mail.hostinger.com ~all" ], "AAAA": [ "2a02:4780:44:a0be:fcb2:b267:b201:4c48", "2a02:4780:45:2e13:d659:439:ae84:3882" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=31536000; includeSubDomains; preload", "message": "Site is compatible with the HSTS preload list!", "compatible": true }, "http_security": { "xFrameOptions": false, "referrerPolicy": "strict-origin-when-cross-origin", "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": "nosniff", "contentSecurityPolicy": "upgrade-insecure-requests", "strictTransportPolicy": "max-age=31536000; includeSubDomains; preload", "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "2a02:4780:44:a0be:fcb2:b267:b201:4c48", "family": 6 }, "redirects": { "chain": [ "https://instander-hq.com" ] }, "subdomains": { "count": 1, "subdomains": [ "www.instander-hq.com" ] }, "linked_pages": { "internal_count": 13 }, "whois": { "registrar": "Atak Domain Bilgi Teknolojileri A.S.", "created": "2026-02-02T06:05:32Z", "updated": "2026-10-04T11:10:37Z", "expires": "2027-02-02T06:05:32Z", "status": [ "ok https://icann.org/epp" ], "nameservers": [ "aurora.dns-parking.com", "nebula.dns-parking.com" ] }, "headers": { "headers": { "server": "hcdn", "content-type": "text/html; charset=UTF-8", "strict-transport-security": "max-age=31536000; includeSubDomains; preload", "content-security-policy": "upgrade-insecure-requests", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin" } } } } ```