By Johannes B. Ullrich, Ph.D. Deceptive Advertisements: What They Do And Where They Come From
https://isc.sans.edu/forums/diary/Deceptive+Advertisements+What+they+do+and+where+they+come+from/22494/
Instagram as Covert Channel
https://www.welivesecurity.com/2017/06/06/turlas-watering-hole-campaign-updated-firefox-extension-abusing-instagram/
Domain Shadowing Used in Rik Exploit Kit
https://blogs.rsa.com/shadowfall/
More Here