# PhishDestroy domain threat record: instander.org.pk

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/instander.org.pk/
Machine-readable companion: https://phishdestroy.io/domain/instander.org.pk/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-19 15:37:25 UTC
- Last availability or vendor check: 2026-10-22 10:47:05 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: gmail

## Stored infrastructure

- Observed IP address: 37.49.225.209
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2025-09-17 22:00:00 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a154ce-a6af-727f-b099-c61cf713a8f4/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/instander.org.pk
- Certificate Transparency search: https://crt.sh/?q=%25.instander.org.pk
- Web Archive lookup: https://web.archive.org/web/*/https://instander.org.pk/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy first observed instander.org.pk on 2026-10-19 and included it in its internal blocklist. Its recorded title advertises a free Instander APK and describes the download as official; that wording does not verify the publisher.

How the scam works
The domain listing does not establish that the advertised application is malicious or show how a visitor would be harmed. Assessing the download itself would require evidence beyond the domain checks summarized here.

Evidence
VirusTotal reported 0 of 92 engines flagging the domain in an analysis dated 2026-09-30, retrieved on 2026-10-19. Google Safe Browsing did not flag it on 2026-10-19. The external blocklists checked on that date returned no matches, and OTX reported zero pulses; PhishDestroy’s own listing is separate from those results.

Infrastructure
The recorded IP address is 37.49.225.209. A TLS check on 2026-10-19 identified Let’s Encrypt / YR1 as the certificate issuer; a certificate does not authenticate an application download.

What to do
Verify the intended publisher before installing the advertised APK. If you submitted credentials on this address, change them through the affected service’s independently verified website. Security teams can examine access logs for this exact hostname without treating unrelated sites at its recorded IP as malicious.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a154ce-a6af-727f-b099-c61cf713a8f4/
VirusTotal report: https://www.virustotal.com/gui/domain/instander.org.pk
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=instander.org.pk
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 18:09:42 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/9HryjVgm/20a76dbf03c0.png
  Captured: 2026-10-19 15:37:25 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a154ce-a6af-727f-b099-c61cf713a8f4.png
  Captured: 2026-10-19 15:37:25 UTC
  Source report: https://urlscan.io/result/01a154ce-a6af-727f-b099-c61cf713a8f4/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/86f3f375-d7db-4bc6-abaa-4c4aeaae2a80.png
  Captured: 2026-10-19 15:37:46 UTC
  Source report: https://radar.cloudflare.com/scan/86f3f375-d7db-4bc6-abaa-4c4aeaae2a80
  SHA-256: c51c18deda9f12a00160382171c4546b92c7a98b7614f7fb2b49e3eedf3af6af
- URLQuery: https://screenshots.phishdestroy.io/uq/a6b06fa8-d427-4b33-a99d-40419546538c.png
  Source report: https://urlquery.net/report/a6b06fa8-d427-4b33-a99d-40419546538c
  SHA-256: 686a5210ecfc4c5eab472f59a452404adb15dc4abc519847fa55707065355a44
- URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a154d0-d656-770a-9dbc-945a4b1472cc.png
  Captured: 2026-10-19 15:39:00 UTC
  Source report: https://urlscan.io/result/01a154d0-d656-770a-9dbc-945a4b1472cc/
  SHA-256: a0353b03004a51ace9ff7695f662967f29a7035cc6f760f19e29816188189913

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T16:43:45Z",
        "uuid": "01a154ce-a6af-727f-b099-c61cf713a8f4",
        "scanned_at": "2026-10-19T15:36:45Z",
        "final_url": "https://instander.org.pk/",
        "status": 200,
        "ip": "37.49.225.209",
        "ips": [
            "37.49.225.209"
        ],
        "asns": [
            "61254"
        ],
        "countries": [
            "NL"
        ],
        "link_domains": [
            "cricfy.video",
            "pikashow.com.co",
            "capcutdownloadapk.com.pk",
            "pikashowapk.video",
            "tiktok-io.net"
        ],
        "doc_hash": "735301857de031e00ff7675875ee4e5af305b86e0cd1e10664a78358fec5a80f",
        "globals": [
            "mobileMenu",
            "closeMenu",
            "toggleDropdown",
            "hamburger",
            "navMenu",
            "navLink"
        ],
        "tls": {
            "san": [
                "instander.org.pk",
                "www.instander.org.pk"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR1",
            "subject": "instander.org.pk",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-23T10:21:25Z",
            "valid_from": "2026-09-24T10:21:26Z"
        },
        "domain_age_days": 392,
        "apex_age_days": 392,
        "tls_age_days": 25,
        "tls_valid_days": 89,
        "requests": 11,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 74,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T17:55:45Z",
        "uuid": "86f3f375-d7db-4bc6-abaa-4c4aeaae2a80",
        "scanned_at": "2026-10-19T15:37:46Z",
        "final_url": "https://instander.org.pk/",
        "status": 200,
        "history": [
            {
                "url": "https://instander.org.pk/",
                "status": 200
            }
        ],
        "dom_hash": "a17bbd6990928de29190b375a8e3439d55df742a99b6777583d2c9173a72cb1c",
        "doc_hash": "735301857de031e00ff7675875ee4e5af305b86e0cd1e10664a78358fec5a80f",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "instander.org.pk",
                "type": "A",
                "value": "37.49.225.209"
            }
        ],
        "dnssec_valid": false,
        "ip": "37.49.225.209",
        "whois": {
            "created": "2025-09-18T00:00:00Z",
            "expires": "2027-09-18T00:00:00Z",
            "nameservers": [
                "bryce.ns.cloudflare.com",
                "evangeline.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-20T18:06:29Z",
        "analysis_at": "2026-10-19T16:14:46Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 1,
            "suspicious": 1,
            "undetected": 35
        },
        "detections": {
            "CRDF": "malicious",
            "SOCRadar": "suspicious"
        },
        "reputation": 0,
        "created": "2025-09-18T00:00:00Z",
        "first_seen": "2025-09-22T11:05:38Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "evangeline.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "bryce.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "37.49.225.209"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "bryce.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-19T16:20:27Z",
        "jarm": "29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae",
        "cert": {
            "san": [
                "instander.org.pk",
                "www.instander.org.pk"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "62a5dabe50560f3127851bf70fb8d0bc134",
            "sha256": "339604839ed499a4adc31fe7842e2f743ac0bfeac0e57ced7492eaf1b8c60cbc",
            "subject": "instander.org.pk",
            "valid_to": "2026-12-23T10:21:25Z",
            "valid_from": "2026-09-24T10:21:26Z"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-21T20:06:43Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "instander.org.pk"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-19T15:41:27Z",
            "first": "2025-12-17T06:15:37Z",
            "changes": 4,
            "days_archived": 9,
            "scans_per_day": 0.03,
            "avg_page_bytes": 10946
        },
        "robots_txt": {
            "present": true,
            "sitemaps": [
                "https://instander.org.pk/sitemap_index.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 2
        },
        "social_tags": {
            "ogUrl": "https://instander.org.pk/",
            "title": "Instander App - Free Download Instander APK Latest Official 2026",
            "author": "Instander App - Free Download Instander APK Latest Official 2026",
            "ogType": "website",
            "robots": "index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1",
            "ogImage": "https://instander.org.pk/images/Instander.webp",
            "ogTitle": "Instander App - Free Download Instander APK Latest Official 2026",
            "keywords": "instander, instander apk download, instander apk, instander mod apk, instander download, instander latest version, instander app download",
            "ogSiteName": "instander.org.pk",
            "description": "Instander APK is an advanced Insta Mod with anti-ban, media download, anti-ad, customization, and personalized experience.",
            "twitterCard": "summary_large_image",
            "twitterSite": "instander.org.pk",
            "canonicalUrl": "https://instander.org.pk/",
            "ogDescription": "Instander APK is an advanced Insta Mod with anti-ban, media download, anti-ad, customization, and personalized experience."
        },
        "trackers": {
            "requests": 8
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 9,
                "tls": 15,
                "wait": 47,
                "connect": 11,
                "download": 12
            },
            "response_ms": 94
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                25,
                53,
                80,
                110,
                143,
                443,
                587,
                993,
                995,
                3306
            ]
        },
        "carbon": {
            "bytes": 47314,
            "co2_grams": 0.0017,
            "cleaner_than": 38
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.44.137",
                    "host": "bryce.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.194.6",
                    "host": "evangeline.ns.cloudflare.com"
                }
            ],
            "zone": "instander.org.pk"
        },
        "location": {
            "ip": "37.49.225.209",
            "asn": "61254",
            "org": "ESTOXY OU",
            "city": "Amsterdam",
            "country": "NL"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR1",
            "subject": "instander.org.pk"
        },
        "dns": {
            "A": [
                "37.49.225.209"
            ],
            "NS": [
                "evangeline.ns.cloudflare.com",
                "bryce.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"bryce.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416243674, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "37.49.225.209",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://instander.org.pk"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Open Graph",
                "HTTP/3"
            ]
        },
        "linked_pages": {
            "external": [
                "https://cricfy.video/",
                "https://pikashow.com.co/",
                "https://capcutdownloadapk.com.pk/",
                "https://pikashowapk.video/",
                "https://tiktok-io.net/"
            ],
            "external_count": 5,
            "internal_count": 14
        },
        "whois": {
            "created": "2025-09-18T00:00:00Z",
            "expires": "2027-09-18T00:00:00Z",
            "status": [
                "Domain is Registered"
            ],
            "nameservers": [
                "bryce.ns.cloudflare.com",
                "evangeline.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "content-type": "text/html; charset=UTF-8"
            }
        }
    }
}
```