instagram-nextjs-three[.]vercel[.]app

The domain instagram-nextjs-three.vercel.app is flagged for brand impersonation, targeting the popular social media platform Instagram. This domain is designed to deceive users into believing they are interacting with a legitimate Instagram service, potentially leading to the compromise of user credentials or other sensitive information.

Analysis indicates that the domain has a VirusTotal score of 23/95, with 23 security vendors flagging it as suspicious. The domain is registered through Tucows Domains Inc. and resolves to the IP address 64.29.17.3, located in the United States and operated by AS16509 Amazon.com, Inc. The domain was created on February 22, 2026, and is currently active. It appears on 2 security blocklists and uses an SSL certificate issued by Google Trust Services / WR1, which may lend a false sense of security to unsuspecting users.

The current status of the domain is active, posing a high risk to users who may fall victim to this impersonation campaign. While it is blocked by PhishDestroy and PhishingDB, the domain remains accessible to users who do not rely on these blocklists. Immediate response actions include updating security configurations to block access to the domain, educating users about the risks of brand impersonation, and monitoring for any signs of credential theft or other malicious activities. Users should avoid interacting with this domain and report any suspicious activity to their security teams.