instagram-clone-eight[.]vercel[.]app

This domain, instagram-clone-eight.vercel.app, is actively engaged in brand impersonation targeting Instagram users for credential theft. The site presents itself as an official Instagram login portal, utilizing identical visual elements and page titles to deceive victims. As of the latest assessment, the domain remains operational and continues to pose a significant risk to users unaware of its fraudulent nature. Analysis indicates the domain was registered through Vercel Inc. and resolves to the IP address 64.29.17.131, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509) in the United States. The SSL certificate is issued by Google Trust Services under the WR1 root, a common feature in both legitimate and malicious domains. The domain was created on March 08, 2026, though this date may reflect automated or backdated registration practices. Security vendors on VirusTotal have flagged the domain as malicious, with 20 out of 95 engines detecting it as a threat. Additionally, the domain appears on one security blocklist and is actively blocked by at least one threat intelligence platform. Current infrastructure and behavioral analysis confirm the domain remains active and capable of harvesting credentials. Organizations and users are advised to block the domain at the network level and implement DNS-based filtering to prevent access. Endpoint protection solutions should be updated to include this domain in their threat signatures. Users who may have interacted with the site should immediately reset their credentials using multi-factor authentication and monitor their accounts for unauthorized activity. Security teams are recommended to review logs for connections to 64.29.17.131 or requests to instagram-clone-eight.vercel.app as indicators of compromise.