instagram-login-page-clone[.]vercel[.]app

The domain instagram-login-page-clone.vercel.app is identified as a credential phishing resource specifically designed to impersonate Instagram, a widely used social media platform. Analysis confirms the domain was actively harvesting user credentials through a fraudulent login interface, posing an elevated risk to unsuspecting visitors. The threat type is classified as credential phishing, with the primary objective of capturing authentication details for unauthorized account access. Infrastructure analysis reveals the domain was registered through Vercel Inc., a legitimate hosting provider often exploited for phishing operations due to its free tier and ease of deployment. The domain resolves to the IP address 64.29.17.195, geolocated within the United States under AS16509, operated by a major cloud infrastructure provider. Detection metrics indicate the domain was flagged by 20 of 95 security vendors on VirusTotal, while independent threat intelligence sources report its presence on two distinct security blocklists. The SSL certificate, issued by Google Trust Services (WR1), does not mitigate the malicious intent, as encrypted connections are commonly used to lend false legitimacy to phishing pages. As of the latest assessment, the domain instagram-login-page-clone.vercel.app has been taken offline, reducing immediate exposure risk. However, similar threats may persist or re-emerge under different subdomains or hosting providers. Users are advised to verify domain authenticity before entering credentials, particularly on pages mimicking branded login portals. Organizations should implement domain-based blocking for known malicious indicators, including the IP 64.29.17.195 and associated subdomains under Vercel’s infrastructure. Continuous monitoring of phishing trends targeting social media platforms is recommended to preempt credential theft attempts.