instagram[.]dlscomunicacao[.]com[.]br

The domain instagram.dlscomunicacao.com.br is flagged as an active high‑risk brand‑impersonation campaign targeting Instagram users. The site currently returns HTTP 403, indicating that direct access is blocked, yet the page title returned by the server is “Instagram”, matching the declared brand target.

Infrastructure analysis shows the domain was registered on 9 April 2012 and resolves to the IPv4 address 162.241.2.69, which belongs to AS19871 operated by Network Solutions, LLC and is geolocated in the United States. The service presents a Let’s Encrypt certificate (R13) and runs Apache HTTP Server with jQuery detected on the page. No authoritative nameserver records are resolvable (NS_NOT_FOUND).

Reputation data indicate the domain appears on two independent blocklists – PhishDestroy and PhishingDB – and has been flagged by 16 of 95 security vendors on VirusTotal. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The combination of a brand‑related page title, a low‑trust score, and inclusion on multiple blocklists aligns with the classification of a social‑media impersonation scam.

Open questions remain regarding the exact content served beyond the title, as no visual or functional analysis is available. The lack of visible nameserver information limits attribution of hosting providers, and the 403 response may be a defensive measure to evade automated crawling. Continued monitoring of DNS resolution and any changes in HTTP response codes is advisable.

Defenders should block the domain at perimeter and endpoint layers, update detection signatures to include the observed IP address and certificate fingerprint, and monitor for related sub‑domains that share the same ASN or hosting footprint. Incident response teams should treat any credential submissions to this domain as compromised and advise affected users to reset authentication tokens for the Instagram service.