youssefchnitef534-del[.]github[.]io

This domain, youssefchnitef534-del.github.io, is an active phishing site designed to steal Instagram login credentials. Visitors are presented with a fake Instagram login page that mimics the legitimate platform, tricking users into entering their usernames and passwords. The stolen credentials are then harvested by threat actors for unauthorized account access, financial fraud, or further social engineering attacks. The site poses a high risk due to its convincing appearance and active status, targeting unsuspecting users who may not recognize the deception. Analysis indicates this domain is hosted on GitHub Pages infrastructure, registered through GitHub, Inc., and resolves to the IP address 185.199.108.153, located in the US under AS54113 (Fastly, Inc.). The site uses a Let's Encrypt SSL certificate (R12) to appear legitimate. Security vendors have flagged this domain as malicious, with 8 out of 95 engines on VirusTotal detecting it as phishing. Additionally, it appears on one security blocklist, and the page title explicitly displays 'Instagram,' reinforcing its intent to impersonate the social media platform. The domain remains active as of this report. If you or someone you know has visited this site and entered login credentials, immediate action is required. First, change the password for the affected Instagram account and enable multi-factor authentication if not already active. Review the account for any unauthorized activity, such as posts, messages, or linked apps that were not authorized. Notify contacts that the account may have been compromised to prevent further spread of phishing attempts. Monitor other accounts that may share the same or similar passwords for signs of unauthorized access. Report the incident to Instagram’s support team and consider using a reputable password manager to generate and store unique passwords for all accounts.