instagramhehbejrrhrjrbrirb[.]blogspot[.]com

This domain, instagramhehbejrrhrjrbrirb.blogspot.com, is identified as a credential phishing resource specifically targeting Instagram users. Analysis indicates the domain was designed to mimic legitimate Instagram login portals, tricking users into submitting account credentials. The domain is currently offline, though prior activity suggests it was actively used in a campaign to harvest sensitive authentication details. Infrastructure analysis reveals the domain was registered through MarkMonitor, Inc. on July 31, 2000, though the subdomain itself appears to have been recently exploited for malicious purposes. It resolved to the IPv6 address 2404:6800:4004:807::2001, hosted under Google LLC’s autonomous system (AS15169) in Australia. The SSL certificate, issued by Google Trust Services (WE2), provided a false sense of security to potential victims. Detection metrics indicate the domain was flagged by 15 of 95 security vendors on VirusTotal, while only one blocklist, PhishDestroy, had previously listed it. The page title, ブログが見つかりません (translation: Blog not found), suggests the phishing content was either removed or relocated prior to takedown. Current status confirms the domain has been taken offline, though residual risk remains due to the potential reuse of harvested credentials. Organizations and users are advised to monitor accounts for unauthorized access, particularly those associated with Instagram. Security teams should review logs for connections to the IPv6 address 2404:6800:4004:807::2001 and the domain itself. Multi-factor authentication is strongly recommended for all social media accounts to mitigate credential theft risks. Additionally, domain registrars and hosting providers should implement stricter monitoring for subdomains leveraging free blogging platforms to distribute phishing content.