xp-expreemy[.]my[.]id

The domain xp-expreemy.my.id was registered on 21 February 2026 through PT Beon Intermedia and is hosted on the IP 103.245.38.141 belonging to AS55688 (PT Beon Intermedia) in Indonesia. The authoritative name servers are best.jagoanhosting.com, great.jagoanhosting.com and one.jagoanhosting.com. No TLS certificate is presented, so connections are unencrypted. The page title retrieved from the site reads “Pusat Bantuan | Centang Biru Terverifikasi Instagram”, indicating an attempt to masquerade as an Instagram support page. VirusTotal has recorded 16 detections out of 93 scanning engines, confirming that multiple security vendors consider the domain malicious.

AlienVault OTX lists the host in two separate threat‑intel pulses, and the domain is listed on one public blocklist. Additional defensive services have taken action: PhishDestroy has blocked the host, and Gridinsoft assigns a trust score of 0 out of 100, reflecting a complete lack of reputation. The observed behavior matches the reported scam type of brand impersonation targeting Instagram users. Evidence is limited to the registration metadata, DNS configuration, IP attribution, and the detection counts listed above; no content‑level analysis such as HTML structure or credential‑collection forms has been published.

Consequently, it remains unclear whether the site ever hosted a functional login portal or what payloads, if any, were delivered to visitors. Defenders should proactively deny any outbound or inbound traffic to 103.245.38.141 and add xp-expreemy.my.id to URL filtering and host‑based blocking lists. Continuous monitoring of the associated IP range and the three JagoanHosting name servers is advised, as the adversary may redeploy the campaign under a new domain that reuses the same infrastructure. Organizations that enforce brand‑specific allow‑lists for Instagram should verify that legitimate Instagram domains are not inadvertently blocked while ensuring this malicious host remains excluded.