instagram-clone-eta-one[.]vercel[.]app

This domain, instagram-clone-eta-one.vercel.app, is currently engaged in brand impersonation targeting Instagram, a high-profile social media platform. The threat type has been classified as brand impersonation, with the page explicitly titled 'Instagram App 2.0' to deceive users into believing it is an official or updated version of the legitimate service. As of the latest assessment, the domain remains active and continues to resolve, posing an ongoing risk to unsuspecting users. Analysis indicates that the domain is flagged by 21 of 95 security vendors on VirusTotal, a significant detection rate that underscores its malicious nature. It was registered through Tucows Domains Inc. on February 21, 2026, and resolves to the IP address 216.198.79.195, which is geolocated in the United States under AS16509, an autonomous system associated with a major cloud provider. The domain appears on one security blocklist, specifically PhishDestroy, and utilizes an SSL certificate issued by Google Trust Services (WR1). Despite its recent creation date, the infrastructure exhibits characteristics typical of phishing campaigns, including the use of a content delivery network to obscure its true origin. The current status of instagram-clone-eta-one.vercel.app remains active, and users are advised to exercise extreme caution. Organizations should consider implementing network-level blocks for the domain and its associated IP address to prevent access. End-users are urged to verify the authenticity of any Instagram-related communications or login portals by cross-referencing official domain names and checking for SSL certificate validity. In cases of suspected compromise, immediate password resets and multi-factor authentication enforcement are recommended. Security teams should monitor for similar domains registered through the same registrar or resolving to the identified IP range, as these may indicate additional components of the same campaign.