recreate-instagrampage[.]vercel[.]app

This domain, recreate-instagrampage.vercel.app, is actively engaged in brand impersonation targeting Instagram users with the intent to harvest login credentials. The phishing page replicates Instagram's visual design and page title, presenting a fraudulent login interface to deceive visitors into submitting sensitive account information. Analysis indicates the domain is specifically crafted to exploit user trust in the Instagram brand, a common tactic in credential theft campaigns targeting social media platforms. Infrastructure analysis reveals the domain is hosted on Vercel Inc.'s platform and resolves to the IP address 64.29.17.3, associated with AS16509 (Amazon.com, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WR1), a legitimate provider, which may lend an appearance of authenticity to unsuspecting users. Detection metrics show 22 out of 95 security vendors on VirusTotal have flagged this domain as malicious, while two independent security blocklists (PhishDestroy and PhishingDB) have already listed it. The domain remains active as of this report, with no evidence of takedown or mitigation. Users who have visited recreate-instagrampage.vercel.app or entered credentials on the site should immediately take corrective action. First, reset the password for the affected Instagram account using a secure, verified device. Enable multi-factor authentication if not already active, and review the account for unauthorized activity, including linked devices, login locations, and recent posts or messages. Monitor connected email accounts for suspicious password reset requests or unauthorized access attempts. If financial or personal data was exposed, consider reporting the incident to relevant data protection authorities and credit monitoring services.