arifagcca-instagram-security[.]onrender[.]com

This domain, arifagcca-instagram-security.onrender.com, is identified as a high-risk brand impersonation threat targeting Instagram users. Analysis indicates the site mimics Instagram’s login interface, presenting a page titled 'Instagram' to deceive victims into submitting credentials. The campaign does not exhibit direct ties to crypto drainer kits but focuses on credential theft through social engineering tactics. Infrastructure analysis reveals the domain resolves to the IP address 216.24.57.7, hosted under AS397273 Render, and was registered through Render Services Inc. The domain is flagged by 20 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly labeling it as phishing. It appears on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend legitimacy to fraudulent sites. As of the latest assessment, the domain has been taken offline, likely due to enforcement actions by the hosting provider or security entities. However, residual risk remains for users who may have interacted with the site prior to its deactivation. Organizations are advised to monitor for credential reuse attempts and implement multi-factor authentication to mitigate potential account compromise. Users should verify domain authenticity before entering credentials on any login portal.