instagramloginforyou[.]github[.]io

The domain instagramloginforyou.github.io is categorized as a high-risk credential phishing threat. It impersonates Instagram to steal user credentials, although no specific drainer kit has been identified. The domain leverages the credibility of GitHub, Inc. to host its phishing content.

Infrastructure analysis reveals that the domain is flagged by 16 out of 95 security vendors on VirusTotal, indicating a significant level of detection. The domain is registered through GitHub, Inc., and resolves to the IP address 185.199.108.153, which is located in the United States and associated with GitHub, Inc. The domain was created on May 12, 2026, and is currently flagged by Google Safe Browsing as a phishing site. Additionally, it appears on one known security blocklist, PhishDestroy.

The domain remains active, posing a continued risk to users who may be misled by its resemblance to a legitimate Instagram login page. Recommended response actions include blocking the domain at the network level, educating users about the threat, and monitoring for any related activity. Despite the current blocklist and vendor detection, the domain's association with a trusted hosting service like GitHub, Inc. may still lead to some user confusion and potential credential theft.