instagram-ios-appg39b[.]rollout[.]site

The domain instagram-ios-appg39b.rollout.site poses a significant threat as a generic phishing site. Analysis indicates that this domain was used to impersonate the legitimate Instagram iOS app, potentially to steal user credentials and personal information. The threat is categorized as elevated due to its active period and the number of security vendors flagging it.

Infrastructure analysis reveals that the domain was registered through NameCheap, Inc. on October 24, 2024. It resolves to the IP address 37.72.169.170, which is located in the United States and belongs to AS29802 HIVELOCITY, Inc. According to VirusTotal, 22 out of 95 security vendors have flagged this domain as malicious. Additionally, the domain appears on two security blocklists: PhishDestroy and PhishingDB. The SSL certificate used was issued by SSL2BUY EMEA LLC, further indicating the domain's intent to appear legitimate and secure.

If users have visited this domain, they are advised to immediately change their Instagram login credentials and monitor their accounts for any unauthorized activity. It is also recommended to run a comprehensive security scan on any devices that may have interacted with the domain. Users should be cautious of unsolicited links and verify the URL of any website requesting sensitive information.