insta-login-clone[.]vercel[.]app

The domain insta-login-clone.vercel.app is currently active and serves a credential phishing page targeting Instagram users, as indicated by the page title "Instagram" and the explicit impersonation of the Instagram brand. The site was registered on April 21, 2026 and resolves to IP address 216.198.79.195, which is geolocated to the United States and associated with a cloud hosting provider. HTTP responses return a status code of 200, and the site presents an SSL certificate signed by a widely recognized certificate authority, providing a false sense of legitimacy. Reputation metrics are extremely low, with Gridinsoft assigning a trust score of 0/100 and Scamadviser a score of 1/100. VirusTotal analysis shows that 24 of 94 security vendors flag the domain, and it appears on at least one public blocklist, confirming malicious activity. Google Safe Browsing (or equivalent) flags classify the site under "SOCIAL_ENGINEERING," reinforcing the phishing nature. The infrastructure includes HSTS enforcement but otherwise offers no additional defensive controls. Uncertainties remain regarding the full scope of phishing campaigns, such as the volume of harvested credentials and any downstream malicious use, because page content and payloads have not been publicly disclosed. Defenders should immediately block network traffic to 216.198.79.195 and add the full hostname to URL filtering policies. Email security gateways should be updated to detect and quarantine messages containing references to this domain. Continuous monitoring of threat intel feeds for additional indicators related to this host is advised, and incident response teams should be prepared to investigate any credential disclosures that may be linked to this site.