instagram-login738[.]github[.]io

This domain, instagram-login738.github.io, operates as a credential phishing site designed to steal Instagram login credentials. Visitors are presented with a fake login interface that mimics the legitimate Instagram platform, tricking users into entering their usernames and passwords. These credentials are then harvested by threat actors for unauthorized account access, identity theft, or further malicious campaigns targeting the victim’s contacts or linked services. Analysis indicates this domain was created on April 15, 2026, and is hosted on GitHub Pages infrastructure, as evidenced by its registration through GitHub, Inc. and resolution to the IP address 185.199.108.153. The domain is flagged by 13 out of 95 security vendors on VirusTotal, with Google Safe Browsing and at least one other security blocklist identifying it as phishing. The SSL certificate, issued by Let’s Encrypt, does not mitigate the risk, as phishing sites frequently use valid certificates to appear legitimate. If you visited instagram-login738.github.io and entered your credentials, immediately change your Instagram password and enable multi-factor authentication. Review your account for unauthorized activity, such as posts, messages, or linked email addresses you did not authorize. Check connected third-party applications for suspicious permissions and revoke access to any unrecognized services. Monitor financial accounts or other platforms where the same credentials may have been reused, as compromised credentials often lead to secondary attacks. Avoid interacting with the domain or any links associated with it.