instagram-login-page-seven[.]vercel[.]app

This domain, instagram-login-page-seven.vercel.app, is an active credential phishing site designed to harvest Instagram login credentials. Analysis indicates the site presents a fraudulent Instagram login interface, tricking users into entering their usernames and passwords, which are then captured by threat actors. The domain specifically targets individuals seeking to access their Instagram accounts, leveraging social engineering tactics to exploit user trust in familiar login prompts. Infrastructure analysis reveals concrete evidence of malicious intent. The domain was registered on February 21, 2026, through Tucows Domains Inc., and currently resolves to the IP address 216.198.79.3, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509). Security vendors have flagged this domain extensively, with 17 out of 95 engines on VirusTotal detecting it as malicious. Additionally, the domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is explicitly labeled as phishing by Google Safe Browsing. The SSL certificate, issued by Google Trust Services (WR1), further confirms the domain's active status, though it does not mitigate the underlying threat. Users who have visited instagram-login-page-seven.vercel.app or entered credentials on this site should take immediate action to mitigate risks. First, change the compromised Instagram password using a secure device and enable multi-factor authentication to prevent unauthorized access. Second, review the account for any unauthorized activity, such as posts, messages, or connected applications, and revoke access to any suspicious third-party services. Finally, monitor linked email accounts for signs of compromise, as threat actors may attempt to exploit additional platforms using the stolen credentials. If financial or sensitive personal information was entered, consider reporting the incident to relevant authorities for further investigation.