instagram-clone-dusky-tau[.]vercel[.]app

This domain, instagram-clone-dusky-tau.vercel.app, is actively engaged in credential harvesting through a generic phishing campaign targeting social media users. The site presents itself as an "Instagram Clone," designed to deceive visitors into entering sensitive login credentials, which are then captured by threat actors. Such campaigns typically exploit trusted branding to lower user vigilance, increasing the likelihood of successful credential theft or account compromise. The infrastructure appears tailored to mimic legitimate services, further enhancing its deceptive capabilities. Analysis indicates the domain was registered through Vercel Inc. on April 28, 2026, and currently resolves to the IP address 216.198.79.3, geolocated to a hosting provider in the United States. The domain appears on one security blocklist, while VirusTotal reports detection by 22 out of 95 security vendors, classifying it as malicious. The SSL certificate is issued by Google Trust Services (WR1), which, while legitimate, does not mitigate the underlying phishing threat. The page title explicitly identifies itself as "Instagram Clone," a clear indicator of its fraudulent intent. Users who have visited instagram-clone-dusky-tau.vercel.app or entered credentials on the site should immediately revoke access to any linked accounts and change passwords for all platforms where the same credentials may have been reused. Enable multi-factor authentication where available to mitigate unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or messages sent without consent. If financial or personally identifiable information was entered, consider reporting the incident to relevant authorities for further guidance on fraud prevention.