insta-clone-johnatanivini[.]vercel[.]app

This domain, insta-clone-johnatanivini.vercel.app, was registered on 19 June 2026 through Vercel Inc. and resolves to the IP address 64.29.17.195, which belongs to Amazon.com, Inc. (AS16509) in the United States. The site presents an HTTPS certificate issued by Google Trust Services under the WR1 authority, and the HTTP response returns status code 200. Technical fingerprints indicate the use of Vercel hosting and HTTP Strict Transport Security (HSTS) is enabled. The page title observed is “Instagram”, directly mirroring the target brand. The domain is classified as a high‑risk brand‑impersonation campaign and is listed on at least one security blocklist, where it has been blocked by PhishDestroy. VirusTotal analysis shows 18 of 95 security vendors flag the domain as malicious, reinforcing the suspicion of a generic phishing operation aimed at credential harvesting for Instagram accounts. Available intelligence does not reveal the underlying nameserver configuration (NS_NOT_FOUND) or any additional infrastructure such as external CDN or secondary hosting services. The Gridinsoft trust score of 0 out of 100 reflects a complete lack of trust, but no further malware or payload details have been uncovered to date. The combination of a matching brand title, a recent registration, active TLS, and multiple vendor detections provides sufficient confidence to treat the site as a live phishing vector. Defenders should immediately block the fully qualified domain name and the associated IP address at network perimeter devices. Email and web gateways should be updated to filter any URLs containing “insta‑clone‑johnatanivini.vercel.app”. Continuous monitoring of the AS16509 address space for similar Vercel‑hosted domains is advised, as the rapid creation window suggests a potential automated campaign. Incident response teams should also advise end users to verify the legitimate Instagram URL (instagram.com) and to report any credential prompts originating from this domain.