instagram-clone-web[.]vercel[.]app

This domain, instagram-clone-web.vercel.app, is confirmed to engage in brand impersonation targeting Instagram users for credential theft. Analysis of the page title (Instagram-clone) and infrastructure reveals a deliberate attempt to mimic Instagram's login interface, likely harvesting user credentials through fraudulent input forms. No crypto drainer kit signatures were detected, but the site's structure aligns with credential harvesting campaigns observed in similar brand impersonation cases. Infrastructure analysis reveals the following technical indicators: The domain resolves to IP 64.29.17.195 (US, AS16509 Amazon.com, Inc.) and is registered through Vercel Inc. Google Safe Browsing flags the domain as phishing, while 22 of 95 security vendors on VirusTotal have detected malicious activity. The domain appears on two security blocklists (PhishDestroy, PhishingDB) and uses an SSL certificate issued by Google Trust Services (WR1). No creation date was provided in available intelligence, but the domain remains actively hosted on Vercel's platform. Current status indicates the domain is still active, posing an ongoing risk to users. Response actions should include immediate blocklisting at the network and endpoint levels, particularly for environments with access to social media platforms. The high risk level is justified by the domain's active exploitation of Instagram's brand trust, combined with its evasion of takedown despite multiple detections. Organizations should monitor for credential reuse attempts from affected users and implement multi-factor authentication as a compensatory control. The domain's hosting on a legitimate platform (Vercel) increases the likelihood of prolonged activity, necessitating continuous monitoring for new variants or redirects.