instagramnewapp[.]ir

The domain instagramnewapp.ir is identified as a brand impersonation threat targeting Instagram. No drainer kit has been identified in the analysis.

This domain is flagged by 18 out of 95 security vendors on VirusTotal. It is registered to the Asiatech Data Transmission company (AS43754) and resolves to the IP address 31.7.65.251, located in Iran (IR). The domain does not have an SSL certificate, which increases the risk of data interception. The domain appears on 2 security blocklists and has no associated creation date or Google Safe Browsing (GSB) status in the provided data.

The domain is currently offline, indicating that it may have been taken down by the hosting provider or the registrar. However, the infrastructure and any associated malicious files should be thoroughly investigated to ensure complete mitigation. Organizations and users should update their threat intelligence feeds to include this domain to prevent potential future attacks. The remaining risk is elevated due to the historical presence on blocklists and the potential for resurgence if not properly decommissioned.