# ig-recovery.com — SUSPICIOUS

> PhishDestroy identifies ig-recovery.com as an active Instagram account recovery phishing domain. VirusTotal shows 0/95 detections. Check the full report.

## Summary
PhishDestroy has identified ig-recovery.com as an active phishing domain posing as an Instagram account recovery service, targeting users affected by account lockouts or hacking incidents. The domain is currently under investigation but remains active, posing a credible threat to social media users seeking legitimate account recovery assistance. The specificity of the threat—masquerading as an Instagram recovery service—significantly increases the risk of credential theft and account compromise, as victims are likely to engage with the site under the assumption of legitimate support.  This domain was flagged by PhishDestroy after analysis revealed several high-risk indicators. Ig-recovery.com was created on September 19, 2025, and resolves to IP address 104.21.11.246. It is registered through GoDaddy.com, LLC, and holds a valid SSL certificate issued by Google Trust Services, which may lend it an air of legitimacy to unsuspecting victims. Despite its recent appearance, the domain has not yet been flagged by VirusTotal anti-malware engines, with 0 out of 95 detection engines marking it as malicious at the time of analysis. This low detection rate suggests a potentially emerging threat that has yet to be widely recognized by security vendors. The combination of a freshly registered domain, a reputable SSL issuer, and absent detections creates a deceptive appearance of trustworthiness, which is a common tactic employed by threat actors to evade detection.  To mitigate exposure to this threat, users should avoid engaging with unsolicited account recovery prompts, especially those directing them to third-party websites. Instagram account recovery should only be initiated through the official platform or application. If you suspect your account has been compromised, use the verified recovery process within the Instagram app or visit help.instagram.com directly. Organizations and individuals should consider blocking the domain ig-recovery.com at the DNS level and reporting the site to Instagram and relevant cybersecurity authorities such as the FBI Internet Crime Complaint Center (IC3) or local cybercrime units. Proactive monitoring of newly registered domains with similar naming conventions (e.g., containing 'ig-' or '-recovery') is also recommended to prevent future exposure to this attack vector.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2025-09-19 17:37:47
- Registrar: GoDaddy.com, LLC
- IP: 104.21.11.246

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/b72b6438-15ff-4cfb-9da5-9af5f2195b80
- PhishDestroy: https://phishdestroy.io/domain/ig-recovery.com/
- LLM endpoint: https://phishdestroy.io/domain/ig-recovery.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/ig-recovery.com/
Last updated: 2026-04-14