instagram-clone-brown-seven[.]vercel[.]app

This domain, instagram-clone-brown-seven.vercel.app, operates as a credential theft platform targeting users through a fraudulent Instagram login interface. Analysis indicates the site captures entered usernames, passwords, and session cookies, enabling account takeovers and unauthorized access to connected services. The cloned interface closely mimics legitimate Instagram branding, including logos, color schemes, and login prompts, making it difficult for users to detect the deception without technical scrutiny. Infrastructure analysis reveals multiple high-confidence indicators supporting this assessment. The domain resolves to IP address 64.29.17.131 within Amazon Web Services (AS16509) and is registered through Tucows Domains Inc. with a creation date of February 21, 2026—an anomalous future date suggesting domain spoofing or registry manipulation. Security vendors have flagged the domain in 18 out of 95 scans on VirusTotal, while Google Safe Browsing and two security blocklists (PhishDestroy and PhishingDB) have independently classified it as malicious. The SSL certificate, issued by Google Trust Services (WR1), provides a false sense of security while facilitating encrypted exfiltration of stolen credentials. Users who have visited this domain should immediately take corrective actions to mitigate potential compromise. First, change passwords for Instagram and any accounts where identical or similar credentials were used, prioritizing email accounts linked to password recovery processes. Enable multi-factor authentication using app-based or hardware tokens rather than SMS-based methods. Review recent login activity within Instagram's security settings for unrecognized sessions and revoke access to suspicious devices. Monitor financial accounts and connected services for unauthorized transactions or configuration changes. If session cookies were entered, log out of all active Instagram sessions and clear browser cookies to invalidate stolen tokens. Consider using a dedicated password manager to generate and store unique credentials for each service, reducing the impact of future credential theft attempts.