goespressoemisso[.]fun

The domain goespressoemisso.fun is a confirmed phishing site engaged in brand impersonation targeting Instagram users. It presents itself as an official Instagram login or verification page to deceive victims into entering credentials, posing an elevated risk of account takeover. No crypto drainer kit was identified. The site is currently taken offline, but prior activity remains a threat to those who interacted with it.

Technical indicators confirm the malicious nature of goespressoemisso.fun. The domain was flagged by 3 of 95 VirusTotal security vendors, including ChainPatrol, alphaMountain.ai, and SOCRadar. It appears on 1 security blocklist (PhishDestroy) but was not flagged by Google Safe Browsing. Registered through HOSTINGER operations, UAB on November 11, 2025, the domain resolves to IP address 104.21.81.169, hosted on Cloudflare's network (AS13335). No SSL certificate was observed, and the page title displayed 'oi Projetos - Soluções em IA e Softwares Empresariais'. Nameservers are ns1.dns-parking.com and ns2.dns-parking.com.

Victims of goespressoemisso.fun should immediately change their Instagram passwords and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized posts or messages sent to contacts. Report the phishing domain to Instagram via their official reporting tools and to anti-phishing organizations like PhishTank or the Anti-Phishing Working Group (APWG). If financial or personal data was exposed, consider placing a fraud alert on credit reports.