logininstagram[.]blogspot[.]com

This domain, logininstagram.blogspot.com, is identified as a credential phishing site specifically designed to impersonate Instagram's login portal. Analysis indicates the site presents a fraudulent login interface to harvest user credentials, a common tactic for account takeover and subsequent malicious activities such as spam distribution or financial fraud. The domain does not appear to be associated with a known drainer kit but leverages the legitimate Blogger platform to evade initial detection. Infrastructure analysis reveals the domain resolves to IP address 142.250.183.33, hosted under AS15169 (Google LLC) in Germany. It is registered through Google Blogger, a free hosting service frequently abused for phishing due to its accessibility and SSL certificates issued by Google Trust Services. The page title, 'Instagram Login,' directly mimics the legitimate service. At the time of assessment, 21 out of 95 security vendors on VirusTotal flagged the domain as malicious. The domain appears on one security blocklist and was proactively blocked by a specialized anti-phishing system. No creation date is publicly available due to the nature of Blogger-hosted content, and Google Safe Browsing status is not explicitly provided in the data. The domain is currently offline, reducing immediate risk to users. However, the infrastructure remains under the control of the threat actor, who may redeploy the phishing page or repurpose the Blogger account for future campaigns. The SSL certificate, while valid, does not indicate legitimacy, as it is automatically provisioned by the hosting provider. Users who interacted with the site should assume credential compromise and take immediate action, including password resets and multi-factor authentication enablement on the affected account. Organizations should monitor for related indicators, such as the IP address and associated Blogger subdomains, to prevent further exploitation.