instagramloginverify[.]blogspot[.]com

instagramloginverify.blogspot.com is a tenant hostname on MarkMonitor, Inc., not a separately registered domain. PhishDestroy first recorded this hostname on Nov 25, 2025. The hostname explicitly references Instagram; stored content metadata identifies the same apparent target. The stored content classification is aml scam. The assembled evidence scores 95/100 (critical).

Four independent sources are positive: VirusTotal, Google Safe Browsing, Cloudflare Radar, and URLScan. VirusTotal recorded 21 detections among 95 engines: ADMINUSLabs, Criminal IP, alphaMountain.ai, BitDefender, CRDF, CyRadar, Ermes, ESET, Emsisoft, Fortinet, G-Data, Google Safebrowsing, Gridinsoft, Kaspersky, Lionic, MalwareURL, Phishing Database, Sophos, Trustwave, VIPRE on Jul 18, 2026 at 18:45 UTC. Google Safe Browsing flagged the domain: Social Engineering on Feb 25, 2026 at 20:32 UTC. Cloudflare Radar classified the hostname as malicious and assigned the categories phishing and security threats; its verdict timestamp was not retained. URLScan returned a malicious verdict with score 100 on Feb 28, 2026 at 01:14 UTC. The evidence is not unanimous. The external blocklist snapshot contained no matches on Aug 7, 2026 at 14:20 UTC. URLQuery recorded no positive detection. PhishStats returned no feed match on Mar 1, 2026 at 05:11 UTC.

HTTP 404 was recorded on Aug 7, 2026 at 01:03 UTC; content was unavailable. MarkMonitor, Inc. is the hosting platform for this tenant, not its registrar. At collection time, the hostname resolved to 2607:f8b0:4004:c19::84 on AS15169 (GOOGLE, US). The associated network metadata labels the endpoint as AS15169 Google LLC in Washington, US. This is shared platform infrastructure; the IP and ASN are hosting context, not attribution to unrelated tenants. The stored server header is GSE. Captured page title: “Instagram”. DOM analysis completed on Jul 29, 2026 at 04:16 UTC; stored DOM score 0/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. IoC extraction completed on Aug 2, 2026 at 04:23 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators. The platform TLS certificate was issued by Google Trust Services / WE2 with validity through Apr 27, 2026; checked Mar 11, 2026 at 19:30 UTC.

The 0/100 DOM score means that the DOM pass stored no scored indicators; it does not negate the independent source findings. Taken together, the page content and independent findings support classifying this hostname as Instagram-themed aml scam.