instagram-clone-sage-ten[.]vercel[.]app

This domain, instagram-clone-sage-ten.vercel.app, is flagged as a high-risk generic phishing site targeting Instagram users. Analysis indicates the page mimics the Instagram login interface, likely designed to harvest credentials or distribute malware. The threat type suggests a credential harvesting operation, potentially linked to broader phishing campaigns exploiting social media platforms for unauthorized access or fraudulent activities. Infrastructure analysis reveals the domain was registered on March 31, 2026, through Vercel Inc., resolving to IP address 216.198.79.131 located in the United States. The domain is detected by 22 out of 95 security vendors on VirusTotal, with SSL certification issued by Google Trust Services (WR1). It appears on one security blocklist, though it is not currently listed on Google Safe Browsing. The registration date is notably in the future, which may indicate an attempt to evade detection or a data entry anomaly in registration records. As of the latest verification (seed f75900), the domain remains active and operational. While it has been blocked by at least one security provider, the lack of broader blocklist inclusion and continued accessibility pose a persistent risk. Users are advised to avoid interaction with the domain, verify URL authenticity before entering credentials, and report the site to relevant security teams for takedown. Organizations should update web filters to block the domain and monitor for related indicators of compromise, such as the associated IP address or SSL certificate issuer.