instaclone-sigma-one[.]vercel[.]app

Analysis of instaclone-sigma-one.vercel.app indicates a high-risk brand impersonation domain targeting Instagram users. The domain was registered on May 7, 2026, through Vercel Inc. and remains active as of July 12, 2026. The page title explicitly displays 'Instagram,' matching the known brand target, and the domain structure ('instaclone') further suggests an attempt to mimic Instagram's branding. Infrastructure analysis reveals the domain resolves to 216.198.79.3, hosted on Amazon.com, Inc. (AS16509) in the United States. The SSL certificate is issued by Google Trust Services, a legitimate provider, which may reduce initial user suspicion but does not mitigate the threat. Technologies detected include Bootstrap, Vercel, and HSTS, consistent with modern phishing pages designed to appear credible. The domain is flagged by one security blocklist and has been detected by 19 of 91 vendors on VirusTotal, confirming malicious classification. Defenders should treat this domain as an active phishing threat, block access at the network level, and monitor for credential harvesting activity. The exact content of the page has not been analyzed, but the combination of brand impersonation, recent registration, and detection by security vendors justifies immediate mitigation.