insta-clone-umber[.]vercel[.]app

This domain, insta-clone-umber.vercel.app, operates as a credential theft platform designed to harvest login details by mimicking the Instagram interface. Visitors are presented with a fraudulent login page titled 'Instagram Clone,' which captures usernames and passwords entered by unsuspecting users. The site’s infrastructure and design closely resemble the legitimate service, increasing the likelihood of successful deception. Analysis indicates the domain is hosted on Vercel Inc.’s platform and resolves to the IP address 216.198.79.67, registered under CYPRESS COMMUNICATIONS, LLC in the United States. Security vendors have flagged the domain in 16 out of 95 detection engines on VirusTotal, confirming its malicious nature. The SSL certificate is issued by Google Trust Services, but this does not mitigate the threat, as fraudulent sites frequently use valid certificates to appear legitimate. Additionally, the domain appears on one security blocklist, further validating its classification as a high-risk credential theft operation. If a user has interacted with this domain, immediate action is required. First, change any passwords entered on the site, particularly for Instagram or other accounts where the same credentials may have been reused. Enable multi-factor authentication on all critical accounts to prevent unauthorized access. Monitor financial and social media accounts for suspicious activity, as stolen credentials can lead to identity theft or further exploitation. Finally, report the domain to relevant security organizations to aid in takedown efforts and prevent additional victims.