instagram-login-clone-delta[.]vercel[.]app

The domain instagram-login-clone-delta.vercel.app is actively hosting a credential‑phishing site that mimics Instagram, as indicated by the page title "Login • Instagram" and the declared scam type of credential phishing. Infrastructure analysis shows the site is served from IP 216.198.79.67, owned by Cypress Communications, LLC in the United States, and uses a Google Trust Services / WR1 SSL certificate issued through Vercel’s hosting platform. HTTP requests return a 200 status, confirming the page is reachable. Threat intelligence records that PhishDestroy has already blocked the domain, Google Safe Browsing flags it for social engineering, and VirusTotal reports detections by 22 of 91 security vendors, with the domain appearing on one external blocklist. The evidence confirms a high‑risk brand‑impersonation campaign targeting Instagram users. Current uncertainties include the exact phishing kit employed and any additional command‑and‑control infrastructure, as these details have not been disclosed. Defenders should immediately block the domain and its resolving IP, update URL filtering and email security policies to flag any references to this host, and monitor for similar Vercel‑hosted subdomains that replicate the "instagram‑login‑clone" pattern. Continuous re‑scanning of the domain is advised to capture any changes in detection rates or hosting configuration.