# PhishDestroy domain threat record: instanderr.org

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/instanderr.org/
Machine-readable companion: https://phishdestroy.io/domain/instanderr.org/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-25 01:32:32 UTC
- Last availability or vendor check: 2026-10-25 23:00:48 UTC
- Stored record updated: 2026-10-25 23:23:02 UTC
- VirusTotal detections in the stored snapshot: 1/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: zoom

## Stored infrastructure

- Observed IP address: 188.114.96.3
- Registrar in stored WHOIS data: Name.com, Inc.
- Last stored HTTP status: 200
- Registration date (registry RDAP, instanderr.org): 2025-03-14 09:50:27 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17078-4982-7710-b90a-b4cb47190e48/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/instanderr.org
- Certificate Transparency search: https://crt.sh/?q=%25.instanderr.org
- Web Archive lookup: https://web.archive.org/web/*/https://instanderr.org/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake system added instanderr.org to its internal blocklist on 2026-10-25 after an automated rule flagged the domain because VirusTotal reported a malicious detection. The recorded page title reads “Instander APK Download Latest Version for Android”, indicating the site claims to provide a modified Instagram application. A HTTP 200 response was observed on the same date, confirming the page was reachable at that time.

How the scam works
Attackers host repackaged versions of popular apps such as Instagram and distribute them as unofficial APK files. When users install these APKs they may grant the app extensive permissions, allowing credential theft, ad injection, or further malware installation on the device.

Evidence
VirusTotal’s domain scan on 2026-10-24 returned one malicious detection out of 92 engines, with Fortinet labeling the domain as malware. Google Safe Browsing checked on 2026-10-25 did not flag the URL. urlscan.io captured a snapshot on 2026-10-25; its machine‑learning engine assigned a malicious score of 91 and marked the page as malicious, while the overall verdict was non‑malicious. No external blocklists listed the domain (0 hits) as of 2026-10-25, and OTX reported no pulses. PhishDestroy’s internal blocklist includes the domain as of 2026-10-25.

Infrastructure
The domain was registered on 2025-03-14 through Name.com, Inc., giving it an age of 589 days at detection. It is served via Cloudflare, with recorded IPv4 addresses 188.114.96.3 and 188.114.97.3 and IPv6 addresses 2a06:98c1:3121::3 and 2a06:98c1:3120::3. The TLS certificate, issued by Google Trust Services, is valid from 2026-08-28 to 2026-11-26.

What to do
Users should avoid downloading any APK from this site; if the modified Instagram app has already been installed, uninstall it, run reputable anti‑malware software, and change any Instagram credentials used. Organizations should block the domain instanderr.org at the network perimeter and monitor DNS logs for queries to it. Add the domain to internal blocklists and continue to watch for related activity in threat feeds.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17078-4982-7710-b90a-b4cb47190e48/
Cloudflare Radar report: https://radar.cloudflare.com/scan/4dfe6d23-960b-4e9f-87f4-08aee3a7a231
Stored capture screenshot: https://i.ibb.co/d4PRBmfY/c7f39e013e97.png
Cloudflare Radar screenshot (2026-10-25T00:34:01Z): https://screenshots.phishdestroy.io/cf/4dfe6d23-960b-4e9f-87f4-08aee3a7a231.png
VirusTotal report: https://www.virustotal.com/gui/domain/instanderr.org
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=instanderr.org
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-25 01:36:39 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/d4PRBmfY/c7f39e013e97.png
  Captured: 2026-10-25 01:32:32 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a17078-4982-7710-b90a-b4cb47190e48.png
  Captured: 2026-10-25 01:32:32 UTC
  Source report: https://urlscan.io/result/01a17078-4982-7710-b90a-b4cb47190e48/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/4dfe6d23-960b-4e9f-87f4-08aee3a7a231.png
  Captured: 2026-10-25 00:34:01 UTC
  Source report: https://radar.cloudflare.com/scan/4dfe6d23-960b-4e9f-87f4-08aee3a7a231
  SHA-256: f924f7bea33a904177d7d8c606da551e1043dcbc01ede243f7fd717e3e6f4298
- URLQuery: https://screenshots.phishdestroy.io/uq/631e198f-ce57-4299-ac21-83e8d758559f.png
  Source report: https://urlquery.net/report/631e198f-ce57-4299-ac21-83e8d758559f
  SHA-256: ac97a7ea1a90e5a0038fb1890088165b4a068c295552440479b31908bd145c6e
- URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a1707c-7032-7768-8f02-2931e71dd608.png
  Captured: 2026-10-25 00:36:11 UTC
  Source report: https://urlscan.io/result/01a1707c-7032-7768-8f02-2931e71dd608/
  SHA-256: 9f58f628721d472a752442fe18d5c0d4b09b18e5898397a5c27c45fc9467723a

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-25T00:36:06Z",
        "uuid": "01a17078-4982-7710-b90a-b4cb47190e48",
        "scanned_at": "2026-10-25T00:31:39Z",
        "final_url": "https://instanderr.org/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://instanderr.org/",
                "from": "http://instanderr.org/",
                "status": 307
            }
        ],
        "ip": "188.114.97.3",
        "domains": [
            "cdnjs.cloudflare.com"
        ],
        "ips": [
            "104.17.24.14",
            "188.114.97.3"
        ],
        "asns": [
            "13335"
        ],
        "link_domains": [
            "www.facebook.com",
            "x.com",
            "www.instagram.com",
            "www.youtube.com",
            "linkedin.com",
            "www.pinterest.com"
        ],
        "social": [
            "https://www.facebook.com",
            "https://x.com",
            "https://www.instagram.com",
            "https://www.youtube.com"
        ],
        "doc_hash": "e435962a4d053582e744f3c70a516e7617a30b27ab769b423fb8387301d7901e",
        "script_hashes": [
            "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8",
            "32539eb3c1487e9e5c285e645695c8ddb8f43e9ecf95e62a79e35300a9632983"
        ],
        "cookies": [
            "PHPSESSID"
        ],
        "tls": {
            "san": [
                "instanderr.org",
                "*.instanderr.org"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "instanderr.org",
            "protocol": "QUIC",
            "valid_to": "2026-11-26T01:44:54Z",
            "valid_from": "2026-08-28T00:47:14Z"
        },
        "domain_age_days": 589,
        "apex_age_days": 589,
        "tls_age_days": 57,
        "tls_valid_days": 90,
        "requests": 37,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 91,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-25T00:36:09Z",
        "uuid": "4dfe6d23-960b-4e9f-87f4-08aee3a7a231",
        "scanned_at": "2026-10-25T00:34:01Z",
        "final_url": "https://instanderr.org/",
        "status": 200,
        "history": [
            {
                "url": "https://instanderr.org/",
                "status": 200
            }
        ],
        "dom_hash": "9c28e91de456c7a3ae5ae4c909ef7c8f0bab529ceef5beffc0e4b074313cefd4",
        "doc_hash": "383b2f1f4cda5c74c262a4744a7e16ef9174a3a738178304c6be3c6d3dfd19df",
        "domain_risks": [
            "Shareware/Freeware",
            "Technology"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "instanderr.org",
                "type": "A",
                "value": "188.114.97.0"
            },
            {
                "name": "instanderr.org",
                "type": "A",
                "value": "188.114.96.0"
            },
            {
                "name": "instanderr.org",
                "type": "AAAA",
                "value": "2a06:98c1:3121::"
            },
            {
                "name": "instanderr.org",
                "type": "AAAA",
                "value": "2a06:98c1:3120::"
            }
        ],
        "dnssec_valid": false,
        "ip": "188.114.97.0",
        "whois": {
            "registrar": "Name.com, Inc.",
            "created": "2025-03-14T09:50:27Z",
            "updated": "2026-08-12T00:25:32Z",
            "expires": "2027-03-14T09:50:27Z",
            "nameservers": [
                "piers.ns.cloudflare.com",
                "raegan.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-25T00:33:36Z",
        "analysis_at": "2026-10-24T12:33:36Z",
        "stats": {
            "timeout": 0,
            "harmless": 54,
            "malicious": 1,
            "suspicious": 0,
            "undetected": 37
        },
        "detections": {
            "Fortinet": "malware"
        },
        "reputation": 0,
        "registrar": "Name.com, Inc.",
        "created": "2025-03-14T09:50:27Z",
        "expires": "2027-03-14T09:50:27Z",
        "updated": "2026-08-12T00:25:32Z",
        "first_seen": "2025-03-15T02:42:09Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.194.240"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "piers.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "TXT",
                "value": "v=spf1 include:_spf.mx.cloudflare.net ~all"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.90.43"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3033::6815:5a2b"
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "route3.mx.cloudflare.net",
                "priority": 44
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "piers.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3031::ac43:c2f0"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "raegan.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "route2.mx.cloudflare.net",
                "priority": 83
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "route1.mx.cloudflare.net",
                "priority": 100
            }
        ],
        "dns_at": "2026-10-24T12:34:09Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "instanderr.org",
                "*.instanderr.org"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "d31694077565b0b91394e94e63c65c81",
            "sha256": "9264dd878058e8085b62ba84b7171945069461d7aff26d3a36bf0990793c215e",
            "subject": "instanderr.org",
            "valid_to": "2026-11-26T01:44:54Z",
            "valid_from": "2026-08-28T00:47:14Z"
        },
        "whois": {
            "registrar": "Name.com, Inc.",
            "registrar_iana_id": "625",
            "registrar_url": "http://www.name.com",
            "created": "2025-03-14T09:50:27Z",
            "updated": "2026-08-12T00:25:32Z",
            "expires": "2027-03-14T09:50:27Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "piers.ns.cloudflare.com",
                "raegan.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-03-14T09:50:27Z",
                "last changed": "2026-08-12T00:25:32Z",
                "registration": "2025-03-14T09:50:27Z",
                "registrar expiration": "2027-03-14T09:50:27Z",
                "last update of RDAP database": "2026-08-12T00:25:32Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-25T00:36:20Z",
        "mail_config": {
            "mx": [
                "route3.mx.cloudflare.net",
                "route2.mx.cloudflare.net",
                "route1.mx.cloudflare.net"
            ],
            "spf": "v=spf1 include:_spf.mx.cloudflare.net ~all",
            "dane": true,
            "spf_lookups": 1
        },
        "caa_records": {
            "domain": "instanderr.org"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-25T00:33:29Z",
            "first": "2025-03-14T19:31:40Z",
            "changes": 16,
            "days_archived": 21,
            "scans_per_day": 0.03,
            "avg_page_bytes": 10017
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://instanderr.org/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 7
        },
        "social_tags": {
            "ogUrl": "https://instanderr.org/",
            "title": "Instander APK Download Latest Version for Android",
            "ogType": "website",
            "robots": "index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1",
            "ogTitle": "Instander APK Download Latest Version for Android",
            "keywords": "instander, instander apk, instander apk download, instander mod apk, instander 16.0 apk download, instander download 2026, instander apk download latest version, instander download",
            "ogSiteName": "Instander APK",
            "description": "Instander APK Download is a highly modified version of the Instagram application, which provides additional functionality and greater security.",
            "twitterCard": "summary_large_image",
            "ogDescription": "Instander APK Download is a highly modified version of the Instagram application, which provides additional functionality and greater security."
        },
        "trackers": {
            "requests": 33,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 5
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 4,
                "tls": 14,
                "wait": 124,
                "connect": 6,
                "download": 10
            },
            "response_ms": 158
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 58863,
            "co2_grams": 0.0022,
            "cleaner_than": 33
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.35.16",
                    "host": "piers.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.194.158",
                    "host": "raegan.ns.cloudflare.com"
                }
            ],
            "zone": "instanderr.org"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "PHPSESSID",
                    "secure": true,
                    "session": true
                }
            ]
        },
        "location": {
            "ip": "2a06:98c1:3121::3",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "instanderr.org"
        },
        "dns": {
            "A": [
                "188.114.96.3",
                "188.114.97.3"
            ],
            "MX": [
                "{\"exchange\": \"route3.mx.cloudflare.net\", \"priority\": 44}",
                "{\"exchange\": \"route2.mx.cloudflare.net\", \"priority\": 83}",
                "{\"exchange\": \"route1.mx.cloudflare.net\", \"priority\": 100}"
            ],
            "NS": [
                "raegan.ns.cloudflare.com",
                "piers.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"piers.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416720207, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "TXT": [
                "v=spf1 include:_spf.mx.cloudflare.net ~all"
            ],
            "AAAA": [
                "2a06:98c1:3121::3",
                "2a06:98c1:3120::3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": "SAMEORIGIN",
            "referrerPolicy": "strict-origin-when-cross-origin",
            "xXSSProtection": "1; mode=block",
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3121::3",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://instanderr.org"
            ]
        },
        "linked_pages": {
            "external": [
                "https://www.facebook.com/",
                "https://x.com/",
                "https://www.instagram.com/",
                "https://www.youtube.com/",
                "https://linkedin.com/",
                "https://www.pinterest.com/"
            ],
            "external_count": 6,
            "internal_count": 27
        },
        "whois": {
            "registrar": "Name.com, Inc.",
            "created": "2025-03-14T09:50:27Z",
            "updated": "2026-08-12T00:25:32Z",
            "expires": "2027-03-14T09:50:27Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "piers.ns.cloudflare.com",
                "raegan.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=UTF-8",
                "x-frame-options": "SAMEORIGIN",
                "x-content-type-options": "nosniff",
                "referrer-policy": "strict-origin-when-cross-origin"
            }
        }
    }
}
```