meta-meta[.]xyz

This domain, meta-meta.xyz, is actively engaged in credential harvesting operations targeting Instagram users. Analysis confirms the domain is currently operational and designed to mimic legitimate Instagram login portals, facilitating unauthorized account access and data exfiltration. The threat type is classified as credential harvesting with a high-risk designation due to its active status and targeted impersonation of a major social media platform. Infrastructure analysis reveals the domain was registered on June 04, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 178.16.54.253, hosted on AS202412 Omegatech LTD in the Netherlands. The domain lacks SSL encryption, increasing exposure to interception risks. Security vendor detections on VirusTotal report 23 of 95 engines flagging the domain as malicious. It appears on one security blocklist, specifically PhishDestroy, and no takedown actions have been observed as of this report. Current threat status remains active, with no indications of infrastructure disruption. Organizations and users are advised to implement immediate blocking of the domain and associated IP address at the network perimeter. Endpoint protection systems should be updated to include this domain in phishing and credential theft detection rules. Given the absence of SSL, network traffic monitoring for plaintext credential transmission to this domain is recommended. Users should be educated on identifying impersonation attempts, particularly those leveraging social media login pages. Domain registrars and hosting providers are encouraged to review the infrastructure for policy violations and potential suspension.