instagram-clone-lake-seven[.]vercel[.]app

The domain instagram-clone-lake-seven.vercel.app has been identified as a credential theft operation specifically targeting Instagram users. Analysis confirms the site impersonates the Instagram login interface, designed to harvest account credentials from unsuspecting victims. The domain is currently offline, though prior activity indicates a focused effort to exploit trust in the Instagram brand. Infrastructure analysis reveals the domain was flagged by 17 of 95 security vendors on VirusTotal, with additional detections on two security blocklists. The domain resolves to IP address 216.198.79.3, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509) in the United States. It was registered through Vercel Inc. and secured with an SSL certificate issued by Google Trust Services (WR1). The page title explicitly mimics Instagram, reinforcing its impersonation tactics. While the domain is no longer active, the indicators remain relevant for detection and prevention. Organizations and users are advised to block the domain and associated IP address in network security controls. Monitoring for similar patterns, such as Vercel-hosted domains impersonating social media platforms, is recommended. Credential theft attempts of this nature often reuse infrastructure; reviewing historical logs for connections to 216.198.79.3 may reveal prior exposure.