instagram-clone-alpha-ten[.]vercel[.]app

Analysis of the domain instagram-clone-alpha-ten.vercel.app indicates a high-risk brand impersonation campaign targeting Google, despite the page title displaying 'Instagram clone.' The domain was registered on February 27, 2026, through Vercel Inc. and resolves to the IP address 216.198.79.131. It is currently active and has been flagged by 19 of 95 security vendors on VirusTotal, as well as appearing on at least one security blocklist. The domain is hosted on Vercel infrastructure, which is commonly used for both legitimate and malicious deployments, and employs HSTS alongside an SSL certificate issued by Google Trust Services. Detection engines assign low trust scores, with Scamadviser and Gridinsoft both rating it 1/100 and 0/100, respectively. While the domain name and page title suggest Instagram-related content, the documented threat type explicitly identifies Google as the impersonated brand. Defenders should treat this domain as malicious, block it at the network level, and monitor for related subdomains or IP associations. Given the discrepancy between the page title and the reported brand target, further investigation into the actual content and redirection behavior is recommended to clarify the campaign's objectives.