instagram-clone-alpha-three[.]vercel[.]app

This domain, instagram-clone-alpha-three.vercel.app, is flagged as a high-risk credential harvesting operation targeting Instagram users. Analysis indicates the site employs brand impersonation techniques, presenting an identical page title (Instagram) and visual design to deceive targets into submitting login credentials. No explicit drainer kit signatures were detected in initial scans, though the domain’s structure and hosting pattern align with known credential theft infrastructure. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Tucows Domains Inc., resolving to IP address 216.198.79.3 (US, AS16509 Amazon.com, Inc.). The SSL certificate is issued by Google Trust Services (WR1), a common characteristic of phishing sites leveraging legitimate CDN services. VirusTotal reports 21 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing (GSB) has not yet listed it. The domain appears on one security blocklist, indicating limited but confirmed detection. As of the latest verification, instagram-clone-alpha-three.vercel.app remains active and unresolved. No takedown requests or registrar suspensions have been observed, leaving the infrastructure intact. The remaining risk is elevated due to the domain’s persistence, low detection rate among major security vendors, and continued hosting on a platform frequently exploited for phishing. Organizations are advised to block the domain at the DNS level, monitor for credential reuse attempts, and alert users to the impersonation threat. Endpoints should be scanned for interactions with the domain or its resolving IP to identify compromised accounts.