naytontop2-ship-it[.]github[.]io

This domain, naytontop2-ship-it.github.io, is an active phishing site designed to harvest Instagram login credentials. Visitors are presented with a fraudulent login page that closely resembles the legitimate Instagram interface, tricking users into entering their usernames and passwords. The stolen credentials are then transmitted to threat actors for unauthorized account access, financial fraud, or further phishing campaigns targeting the victim's contacts. Analysis indicates this domain is part of a credential phishing operation. It is hosted on GitHub Pages (registered through GitHub, Inc.) and resolves to the IP address 185.199.108.153, located in the US under AS54113 (Fastly, Inc.). The site uses a Let's Encrypt SSL certificate (R12) to appear legitimate, though this does not guarantee safety. As of the latest scan, 8 out of 95 security vendors on VirusTotal flag this domain as malicious. Additionally, Google Safe Browsing classifies it as a phishing site, and it appears on at least one security blocklist. The page title explicitly displays 'Instagram,' further confirming its intent to deceive users. If you visited naytontop2-ship-it.github.io and entered your credentials, take immediate action to secure your account. First, change your Instagram password using a trusted device and enable two-factor authentication if not already active. Review your account for any unauthorized activity, such as posts, messages, or linked apps you did not authorize. Notify your contacts that your account may have been compromised to prevent secondary phishing attempts. Monitor your email and other linked accounts for suspicious login attempts or password reset requests. If financial information was entered, contact your bank or payment provider to report potential fraud. Finally, scan your device for malware using updated security tools to ensure no additional threats were introduced.