insta-clone-app[.]vercel[.]app

Analysis of insta-clone-app.vercel.app confirms it as an active credential-phishing domain targeting Instagram users. The domain, registered on May 24, 2026, resolves to IP 64.29.17.67, hosted by Vercel in the United States. Its SSL certificate is issued by Google Trust Services (WR1), a common feature in both legitimate and malicious sites, offering no inherent trust signal. The page title explicitly displays 'instagram', aligning with the known impersonation of the Instagram brand. Security vendors have flagged this domain, with 17 of 91 engines on VirusTotal detecting it as malicious, and it appears on at least one security blocklist. The domain returns an HTTP 200 status, indicating an operational webpage, and Gridinsoft assigns it a trust score of 0/100, further corroborating its malicious classification. While the exact phishing kit or backend infrastructure remains unconfirmed, the domain’s purpose is clearly defined as credential harvesting, based on its categorization as a credential-phishing site. Defenders should treat this domain as a high-risk threat, block it at the network level, and monitor for related indicators such as the resolving IP or associated SSL certificate issuer. Given its active status and direct targeting of a major social media platform, immediate mitigation is recommended to prevent user compromise.