gallery[.]billy-chiu[.]com

This domain, gallery.billy-chiu.com, is identified as a credential phishing infrastructure designed to impersonate Instagram. Analysis confirms the presence of a cloned authentication interface, as evidenced by the page title "Instagram" and the domain’s inclusion on multiple security blocklists. The infrastructure appears to be tailored for harvesting user credentials, a common tactic in account takeover campaigns targeting social media platforms. Infrastructure analysis reveals the domain was registered on May 29, 2024, through Porkbun LLC and resolves to the IP address 66.33.60.193, hosted on Amazon.com, Inc. (AS16509). Security vendor detections on VirusTotal indicate 22 out of 95 engines flagged the domain as malicious. The domain is currently listed on two security blocklists, PhishDestroy and PhishingDB, and was secured with a Let’s Encrypt SSL certificate (R12). No association with known drainer kits or additional payload delivery mechanisms has been observed in available telemetry. The domain is presently offline, likely due to takedown actions or infrastructure suspension. However, residual risk remains, as threat actors may re-deploy similar infrastructure using newly registered domains or alternative hosting providers. Organizations and users are advised to monitor for domains mimicking Instagram’s branding, particularly those with recent creation dates or hosted on shared cloud infrastructure. Network-level blocking of the observed IP (66.33.60.193) and domains registered through the same registrar may mitigate exposure to related campaigns.