xj-instagram[.]vercel[.]app

The domain xj-instagram.vercel.app has been identified as a high-risk phishing threat specifically engaging in brand impersonation of Instagram. The site misleadingly mimics the legitimate Instagram interface, potentially aiming to harvest user credentials or distribute malware. This tactic is commonly employed in phishing campaigns to deceive users into believing they are interacting with a trusted source. The threat vector is characterized by its use of a platform that allows rapid deployment of web applications, an aspect which contributes to the threat's persistence and distribution.

Technical analysis reveals several precise indicators of compromise. The domain is currently reported by 21 out of 95 security vendors on VirusTotal as malicious. It is registered through Vercel Inc., a service that facilitates the deployment of web projects. The domain resolves to IP address 216.198.79.3, which is associated with Amazon.com, Inc. (AS16509) based in the United States. The domain's SSL certificate is issued by Google Trust Services, indicating the usage of secure communications, albeit for malicious purposes. Additionally, this domain is present on at least two security blocklists, specifically identified by PhishDestroy and PhishingDB, further substantiating the threat.

Currently, the domain remains active, posing ongoing risks to users who may inadvertently visit the site. It is crucial for users to avoid interactions with this domain and for network administrators to implement blocklisting measures. Security teams should also monitor for similar threats, as such domains often serve as precursors to broader phishing campaigns. Given the current detection landscape and vendor reports, it is advisable to maintain vigilant tracking and rapid response capabilities to mitigate risk and protect users from potential data breaches or credential theft.