accounts-secure[.]live

The domain accounts-secure.live is actively engaged in credential phishing targeting Instagram users. Analysis confirms the domain is operational, impersonating the Instagram login interface to harvest account credentials. The infrastructure remains accessible as of the latest verification, posing an ongoing risk to users. Infrastructure analysis reveals the domain was registered on May 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 82.221.136.26, hosted on AS50613 (Advania Island ehf) in Iceland. Security vendor assessments on VirusTotal indicate 19 of 95 engines flag the domain as malicious. The domain appears on one security blocklist, specifically PhishDestroy, and utilizes a Let's Encrypt SSL certificate (identifier: YR1). The page title explicitly displays "Instagram," reinforcing the impersonation theme. Current risk assessment classifies this domain as high due to its active status, confirmed credential harvesting intent, and detection by multiple security vendors. Organizations and individuals are advised to block the domain and associated IP at the network perimeter. End-users should verify URLs before entering credentials, enable multi-factor authentication on critical accounts, and report suspicious login prompts to platform security teams. Monitoring for similar domains registered through the same registrar or resolving to the same IP may uncover related phishing campaigns.