social--social-8b962[.]us-central1[.]hosted[.]app

This domain, social--social-8b962.us-central1.hosted.app, is flagged for brand impersonation targeting Instagram users. Analysis indicates the threat actor deployed a fake login portal mimicking Instagram's authentication interface, as evidenced by the page title "Instagram • Login." The infrastructure appears designed to harvest credentials from unsuspecting victims, though no direct evidence of a crypto drainer or secondary payload was observed in this instance. The domain leverages Google's hosted app platform, a common tactic to exploit trusted cloud providers for phishing operations. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 198.18.2.72, hosted on Google LLC's AS19527 in South Korea. The SSL certificate is issued by Google Trust Services (WR3), a legitimate provider often abused for phishing. VirusTotal detection metrics show 21 out of 95 security vendors flagging the domain as malicious. The domain appears on two independent security blocklists, including community-driven repositories. Registration details confirm Google LLC as the hosting provider, with no public WHOIS data available due to cloud-based domain masking. No Google Safe Browsing (GSB) listing was recorded at the time of analysis. Current status indicates the domain has been taken offline, likely due to abuse complaints or automated takedown mechanisms. However, residual risk remains elevated due to the domain's prior activity and potential for reactivation under a new subdomain or IP. Users who interacted with this domain are advised to reset credentials immediately, enable multi-factor authentication, and review connected applications for unauthorized access. Organizations should monitor for similar patterns, such as Google-hosted subdomains with "social" or brand-related keywords, as threat actors frequently rotate infrastructure within cloud providers to evade detection.