clone-instagram-by-enju[.]vercel[.]app

This domain, clone-instagram-by-enju.vercel.app, is identified as a high-risk phishing site impersonating Instagram, a social media platform. Analysis indicates the threat type is a fake login page designed to harvest user credentials. The domain mimics the Instagram brand, likely leveraging a pre-built phishing kit to replicate the platform's login interface, increasing the likelihood of successful credential theft from unsuspecting victims. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 216.198.79.131, hosted in the United States under Vercel, Inc. It was registered on May 19, 2024, through Vercel Inc. The SSL certificate is issued by Google Trust Services (WR1). The domain appears on one security blocklist and is flagged by 19 out of 95 security vendors on VirusTotal. Google Safe Browsing (GSB) status is not explicitly provided, but the domain remains active and unmitigated. As of the latest assessment, clone-instagram-by-enju.vercel.app remains active, posing a persistent risk to users. Immediate response actions include blocking the domain at the network level, alerting affected users, and monitoring for credential reuse across other platforms. The remaining risk is classified as high due to the domain's active status, low detection rate on some security platforms, and the potential for credential harvesting to lead to further account takeovers or identity theft. Users are advised to avoid interacting with the domain, reset credentials if exposed, and enable multi-factor authentication on all critical accounts.