The full anatomy of a phishing site,
one URL at a time.
ZeroPhish renders the page, runs twelve detection signals against the DOM, certificate chain, brand fingerprint and threat feeds, and returns a typed verdict. Built for security teams and product engineers.
No phishing signals detected
| URL | hxxps://www[.]instagram[.]com/reel/DZVH2CrpOcC/?igsh=cWY3azlldDdjb3Nn | |
| Host | www[.]instagram[.]com | |
| Registered domain | instagram[.]com | |
| Brand | ||
| Screenshot | https://cdn.zerophish.ai/7139fb4e-1aec-4bf7-883b-3f6d7c332eeb.jpg | |
| Scan ID | 6edfab73-c8b8-4e39-b293-e00feb92c4af |
|
154 d ago
|
PHISHING | instagram.com | view → |
|
309 d ago
|
REVIEW | www.instagram.com | safe |
| Host | www.instagram.com |
| Registered domain | instagram.com |
| Scheme | https |
| Content length | 688816 B |
| HTTP | 200 · text/html |
| JARM | 7939b39b37937930320320320320128c19258acd09ccdea8faad630541ff7e |
| Redirect hops | 1 |
The page is presenting itself as Instagram content (“Instagram” in the HTML title/SVG and the OCR text includes the Instagram footer like “© 2026 Instagram from Meta”). The URL is a legitimate Instagram domain and path for a reel (instagram.com/reel/…), indicating the request is for an in-site media page rather than an off-brand landing page.
Suspicious phishing signals are largely absent: there is no visible lookalike brand, no urgent payment/security warning text, and no external redirect patterns typical of phishing. While the header/navigation includes links like “Log In” and “Sign Up,” the provided HTML/OCR does not show an actual credential-collection form requesting a username/password on this page.
Because the branding matches Instagram and the URL belongs to instagram.com, the phishing risk is low. Any login-related elements appear to be normal site navigation rather than a harvesting form.