enlacedirectointagram[.]blogspot[.]com

This domain, enlacedirectointagram.blogspot.com, is flagged as a credential phishing site targeting Instagram users. Analysis confirms the domain is currently offline, though prior activity impersonated Instagram login pages to harvest user credentials. The infrastructure was designed to mimic legitimate authentication flows, increasing the likelihood of successful compromise for unsuspecting victims. Infrastructure analysis reveals the domain was registered on March 01, 2026, through MarkMonitor, Inc., a registrar commonly associated with both legitimate and malicious domains. It resolved to the IP address 142.251.140.161, geolocated in the United States under AS15169 (Google LLC), indicating hosting on a major cloud provider’s infrastructure. The domain appears on one security blocklist, and VirusTotal reports 20 of 95 security vendors flagging it as malicious. The SSL certificate, issued by Google Trust Services (WE2), aligns with standard practices but does not mitigate the underlying threat. Current status indicates the domain has been taken offline, reducing immediate risk to users. However, the infrastructure may resurface under a different domain or hosting provider. Organizations and users are advised to block the domain at the network level and monitor for similar phishing attempts targeting Instagram or other social media platforms. Security teams should review logs for connections to 142.251.140.161 and the domain itself, while end-users should enable multi-factor authentication on all accounts to mitigate credential theft risks.