instagram[.]williamzshih[.]com

This domain, instagram.williamzshih.com, is currently under investigation for brand impersonation targeting Instagram. Analysis indicates the domain was registered on March 14, 2026, and resolves to the IP address 64.29.17.65. The page title explicitly displays 'Instagram,' aligning with the identified threat type of brand impersonation. Infrastructure analysis reveals the use of Cloudflare for registration, while detected technologies include Node.js, React, Vercel, Next.js, HSTS, and Webpack, suggesting a modern web application stack commonly employed in both legitimate and malicious deployments. The domain holds a Gridinsoft trust score of 0 out of 100, a metric that reflects high-risk characteristics based on historical and behavioral patterns. It appears on one security blocklist, specifically PhishDestroy, which has flagged it for potential phishing activity. The SSL certificate is issued by Let’s Encrypt, a common provider for both legitimate and malicious sites, offering no definitive indication of intent. While VirusTotal reports 0 detections out of 95 engines, this absence of flags does not confirm safety, as newer or sophisticated threats may evade initial detection. At present, the domain remains active, and its exact content has not been fully analyzed. The combination of a low trust score, blocklist inclusion, and alignment with Instagram’s branding raises concerns about its legitimacy. Defenders should treat this domain as suspicious, particularly in environments where Instagram credentials or user interactions are critical. Monitoring for further blocklist additions, user reports, or behavioral anomalies is recommended. If additional evidence of phishing or credential harvesting emerges, immediate containment measures such as DNS filtering or endpoint blocking may be warranted.