instagram-clone-nine-delta[.]vercel[.]app

PhishDestroy identifies instagram-clone-nine-delta.vercel.app as an active crypto drainer posing as a fake Instagram login portal. This domain mimics legitimate social media authentication flows to trick users into surrendering cryptocurrency wallet credentials or directly draining connected wallets. The threat actor leverages Vercel’s hosting infrastructure to deploy a convincing clone, exploiting the platform’s trusted SSL certificate from Google Trust Services to enhance credibility. Users encountering this domain should exercise extreme caution, as interaction may result in irrecoverable financial losses.

This domain was flagged by 13 out of 95 leading security vendors on VirusTotal, indicating widespread malicious recognition. Registered through Vercel Inc., the domain resolves to IP address 216.198.79.3, which has been associated with multiple phishing campaigns targeting cryptocurrency users. While creation details remain undisclosed, the domain’s recent deployment aligns with a surge in social media impersonation attacks aimed at siphoning digital assets. Blocklist aggregators have flagged this domain in at least 30 independent threat intelligence feeds, reinforcing its elevated risk profile.

If you’ve visited or interacted with instagram-clone-nine-delta.vercel.app, immediately disconnect any active crypto wallets and revoke unauthorized permissions via your wallet provider’s security settings. Scan connected devices for malware using reputable antivirus tools, as crypto drainers often deploy keyloggers or clipboard hijackers. Report the domain to PhishDestroy and your financial institutions to mitigate further exposure. Avoid re-engaging with the site, and warn others who may have encountered similar Instagram-themed lures. Proactive verification of domains via PhishDestroy’s database can prevent future credential or asset compromise.