# PhishDestroy domain threat record: insta1login.github.io

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/insta1login.github.io/
Machine-readable companion: https://phishdestroy.io/domain/insta1login.github.io/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-14 14:09:01 UTC
- Last availability or vendor check: 2026-10-23 01:23:53 UTC
- Stored record updated: 2026-10-23 22:21:43 UTC
- VirusTotal detections in the stored snapshot: 9/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: facebook

## Stored infrastructure

- Observed IP address: 185.199.108.153
- Registrar in stored WHOIS data: GitHub Pages
- Last stored HTTP status: 404
- Registration date (registry RDAP, github.io): 2013-03-08 19:12:48 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0a001-abcb-73f9-8403-e226da4194a0/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/insta1login.github.io
- Certificate Transparency search: https://crt.sh/?q=%25.insta1login.github.io
- Web Archive lookup: https://web.archive.org/web/*/https://insta1login.github.io/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
insta1login.github.io was a credential phishing page hosted as a free GitHub Pages project. It was aimed at people who sign in to Instagram or Facebook. PhishDestroy first flagged it on 2026-09-14, and it went offline the next day, 2026-09-15. When checked again on 2026-10-19, the site was still dead, with nothing served at its root.

How the scam works
The page carried the title "Instagram" and a name built to look like an Instagram login address. Our classification lists the impersonated brand as Facebook, consistent with the brand scanners picked up on the page. Pages like this copy a familiar sign-in form, and the username and password a victim types are sent to the operator instead of the real service. With those credentials the attacker can take over the account, lock out the owner, message their contacts with further scams, or reuse the password on other services.

Evidence
VirusTotal returned nine detections out of 89 engines on 2026-09-16. The flagging vendors include alphaMountain.ai, Emsisoft, Fortinet, G-Data, Gridinsoft, LevelBlue, Netcraft and Sophos. That is a modest share of engines, but it is a meaningful spread of independent security vendors for a page that survived only about a day. urlscan.io rated the page malicious and recognised Facebook branding on it. PhishDestroy lists the domain on its blocklist.

Infrastructure
The site was not a registered domain but a subdomain on GitHub Pages. Anyone can publish there for free, and pages can be created and abandoned quickly. Traffic was served from Fastly's network in the United States, the delivery network GitHub uses for these pages. This free, disposable setup fits the site's short lifespan: it went dark within roughly a day of first being flagged.

What to do
If you entered your login on this page, change your Instagram and Facebook passwords immediately, plus any other account where you reused that password. Turn on two-factor authentication with an authenticator app, then review active sessions and log out unfamiliar devices. Also check your account email, phone number and recovery options for changes an attacker may have made. Watch your messages for scam links sent in your name, and warn friends if any appear. Defenders should block the hostname, look for it in proxy and email logs, and treat GitHub Pages subdomains that mimic brand login pages as high-risk.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0a001-abcb-73f9-8403-e226da4194a0/
VirusTotal report: https://www.virustotal.com/gui/domain/insta1login.github.io
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=insta1login.github.io
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:18:45 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a0a001-abcb-73f9-8403-e226da4194a0.png
  Captured: 2026-09-14 14:09:01 UTC
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/70a8b5d6-a669-4f92-9d58-7b3953f43133.png
  Captured: 2026-09-14 14:13:32 UTC
  Source report: https://radar.cloudflare.com/scan/70a8b5d6-a669-4f92-9d58-7b3953f43133
  SHA-256: 945c4699741e079455940b39652bded28d3c3ecc2dde09ffe7aaa9f9d3ff0ddc
- URLScan · 2026-09-14: https://screenshots.phishdestroy.io/us/01a0a043-e8e4-7329-bf34-ce9b1cdb97e5.png
  Captured: 2026-09-14 14:13:26 UTC
  Source report: https://urlscan.io/result/01a0a043-e8e4-7329-bf34-ce9b1cdb97e5/
  SHA-256: 6f8cf461abf6f0981fbdf94a9989850c5ea3b679650ebe74f85399fed3922ea9
- URLScan · 2026-09-16: https://screenshots.phishdestroy.io/us/01a0a879-e678-73cc-a3d6-929d37255972.png
  Captured: 2026-09-16 04:29:24 UTC
  Source report: https://urlscan.io/result/01a0a879-e678-73cc-a3d6-929d37255972/
  SHA-256: 1a73c6040f03fb13f4ed104e21c3546014a34da5e8f242337f2e1b5a1740b81d
- URLScan · 2026-09-20: https://screenshots.phishdestroy.io/us/01a0c102-3455-7570-ad05-57c7b262c858.png
  Captured: 2026-09-20 22:49:15 UTC
  Source report: https://urlscan.io/result/01a0c102-3455-7570-ad05-57c7b262c858/
  SHA-256: 1a73c6040f03fb13f4ed104e21c3546014a34da5e8f242337f2e1b5a1740b81d
- URLScan · 2026-09-21: https://screenshots.phishdestroy.io/us/01a0c205-ace3-71ae-a6f3-f24428361cb9.png
  Captured: 2026-09-21 03:32:49 UTC
  Source report: https://urlscan.io/result/01a0c205-ace3-71ae-a6f3-f24428361cb9/
  SHA-256: 1a73c6040f03fb13f4ed104e21c3546014a34da5e8f242337f2e1b5a1740b81d

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T00:15:04Z",
        "uuid": "01a0a001-abcb-73f9-8403-e226da4194a0",
        "scanned_at": "2026-09-14T13:01:05Z",
        "final_url": "https://insta1login.github.io/Reel/",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://insta1login.github.io/Reel/",
                "from": "https://insta1login.github.io/Reel",
                "status": 301
            }
        ],
        "ip": "2606:50c0:8003::153",
        "domains": [
            "cdn.jsdelivr.net"
        ],
        "ips": [
            "2a04:4e42::485",
            "2606:50c0:8003::153"
        ],
        "asns": [
            "54113"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "ebad22b81b33b6351a966595795dbbf4ceaf5fcb863804d59ce87328e69c4cec",
        "script_hashes": [
            "7e97b544c89e6700e3f1656f520f20d855a128dc4982fa10bca6661be2778e64"
        ],
        "globals": [
            "emailjs",
            "InstagramLogin"
        ],
        "tls": {
            "san": [
                "*.github.com",
                "*.github.io",
                "*.githubusercontent.com",
                "github.com",
                "github.io",
                "githubusercontent.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR1",
            "subject": "*.github.io",
            "protocol": "TLS 1.3",
            "valid_to": "2026-10-31T23:38:01Z",
            "valid_from": "2026-08-02T23:38:02Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 42,
        "tls_valid_days": 89,
        "requests": 7,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "facebook"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Facebook"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "GitHub.com",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=31556952"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T00:26:07Z",
        "uuid": "70a8b5d6-a669-4f92-9d58-7b3953f43133",
        "scanned_at": "2026-09-14T14:13:32Z",
        "final_url": "https://insta1login.github.io/",
        "status": 404,
        "history": [
            {
                "url": "https://insta1login.github.io/",
                "status": 404
            }
        ],
        "dom_hash": "35bbdd99a249decabdc93f6b809b030db834533d4d78fe69529a214489fae670",
        "doc_hash": "70d613e3acfba24fd2876fcbacaf639e1e111ef4d54baf70761c47673f37d6a3",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "insta1login.github.io",
                "type": "A",
                "value": "185.199.110.153"
            },
            {
                "name": "insta1login.github.io",
                "type": "A",
                "value": "185.199.111.153"
            },
            {
                "name": "insta1login.github.io",
                "type": "A",
                "value": "185.199.108.153"
            },
            {
                "name": "insta1login.github.io",
                "type": "A",
                "value": "185.199.109.153"
            },
            {
                "name": "insta1login.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8000::153"
            },
            {
                "name": "insta1login.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8001::153"
            },
            {
                "name": "insta1login.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8002::153"
            },
            {
                "name": "insta1login.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8003::153"
            }
        ],
        "dnssec_valid": false,
        "ip": "185.199.110.153",
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "created": "2013-03-08T19:12:48Z",
            "updated": "2026-08-12T09:08:04Z",
            "expires": "2027-03-08T19:12:48Z",
            "nameservers": [
                "ns-692.awsdns-22.net",
                "ns-1622.awsdns-10.co.uk",
                "dns1.p05.nsone.net",
                "dns2.p05.nsone.net",
                "dns3.p05.nsone.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T11:57:17Z",
        "analysis_at": "2026-10-14T15:39:34Z",
        "stats": {
            "timeout": 0,
            "harmless": 50,
            "malicious": 7,
            "suspicious": 2,
            "undetected": 33
        },
        "detections": {
            "ESET": "suspicious",
            "Webroot": "malicious",
            "Emsisoft": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "LevelBlue": "suspicious",
            "Gridinsoft": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "MarkMonitor Inc.",
        "created": "2013-03-08T19:41:10Z",
        "expires": "2027-03-08T19:12:48Z",
        "updated": "2026-08-12T09:08:04Z",
        "first_seen": "2026-09-13T14:10:53Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.108.153"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.111.153"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.110.153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "letsencrypt.org"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "sectigo.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "letsencrypt.org"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "sectigo.com"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8003::153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "digicert.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "digicert.com"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8000::153"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.109.153"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8002::153"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8001::153"
            }
        ],
        "dns_at": "2026-10-14T15:57:36Z",
        "jarm": "29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36c",
        "cert": {
            "san": [
                "*.github.com",
                "*.github.io",
                "*.githubusercontent.com",
                "github.com",
                "github.io",
                "githubusercontent.com"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "6a65e5d3279ba564a4de74eb5d64478dbb8",
            "sha256": "f2f9a159ce50a0a168b3eaeaf2fced5addd49ba38e2bf63248f057a139fc7856",
            "subject": "*.github.io",
            "valid_to": "2026-12-29T23:44:45Z",
            "valid_from": "2026-09-30T23:44:46Z"
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "registrar_iana_id": "292",
            "registrar_url": "http://www.markmonitor.com",
            "created": "2013-03-08T19:12:48Z",
            "updated": "2025-02-25T20:53:31Z",
            "expires": "2027-03-08T00:00:00Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited",
                "clientUpdateProhibited"
            ],
            "nameservers": [
                "dns1.p05.nsone.net",
                "dns2.p05.nsone.net",
                "dns3.p05.nsone.net",
                "ns-1622.awsdns-10.co.uk",
                "ns-692.awsdns-22.net"
            ],
            "dnssec": "unsigned"
        }
    }
}
```