harmonynews[.]one

Analysis indicates that the domain harmonynews.one is actively used for a high‑risk Instagram brand‑impersonation campaign. The site presents the page title “Harmony (ONE) – Latest News and Updates” but its branding matches the Instagram target, classifying it as a social‑media scam. The domain remains registered through NameCheap, Inc., with a creation date of 25 Nov 2022, and it continues to resolve to the Cloudflare edge address 172.67.130.212. Infrastructure analysis reveals the domain is served behind Cloudflare, using the nameservers evangeline.ns.cloudflare.com and khalid.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services under the WE1 authority, providing valid HTTPS with HSTS enabled. MX records include entries pointing to eforward3.registrar-servers.com (priority 10). The web stack is identified as WordPress running on PHP with MySQL backend, augmented by Yoast SEO, Cloudflare Browser Insights, and HTTP/3 support. Threat intel shows the domain appears on one public security blocklist and is listed by PhishDestroy as blocked. VirusTotal scans have flagged the domain by 8 of 95 security vendors, and Gridinsoft assigns a trust score of 0 out of 100, underscoring the malicious intent. HTTP responses return status 200, confirming the site is actively serving content. Defenders should block the domain at perimeter defenses and update DNS blacklists to include harmonynews.one. Email filters should be tuned to detect references to the Instagram brand from this domain, and security teams should monitor for any credential‑harvesting activity linked to the IP address 172.67.130.212. Continuous monitoring of Cloudflare‑hosted assets for similar impersonation patterns is recommended.