instagram[.]webpromotion-business[.]site

This domain, instagram.webpromotion-business.site, was created on 21 August 2023 and continues to resolve to the IPv4 address 162.43.122.184. Registration records show the domain is hosted by XServer, Inc., with the full set of XServer name servers (ns1.xserver.jp through ns5.xserver.jp) listed in the zone file. VirusTotal has recorded 16 positive detections out of 91 scanned scanners, indicating that a majority of security vendors consider the domain malicious. The same domain appears on three public phishing blocklists—PhishDestroy, OpenPhish, and Phishunt—reinforcing the assessment that it is being used for phishing operations.

The threat type is identified as generic phishing, and the risk level is classified as high. Current intelligence does not contain details on the TLS certificate, HTTP response codes, page title, or any observed payload, so the exact content served to victims remains unknown. Likewise, no attribution to specific malware kits or infrastructure beyond the hosting IP has been disclosed.

Defenders should block network connections to 162.43.122.184 and add instagram.webpromotion-business.site to URL filtering policies. Monitoring for DNS queries to the listed XServer name servers can provide early warning of further campaign activity. Continuous re‑scanning on platforms such as VirusTotal is recommended to capture any changes in detection rates, and periodic checks against phishing feed providers should be performed to verify whether additional blocklist entries appear.