ig-clone-gamma[.]vercel[.]app

Analysis of ig-clone-gamma.vercel.app as of July 19, 2026 confirms an active phishing site targeting Instagram credentials. The domain, hosted on Vercel infrastructure (IP 64.29.17.195, US), returns an HTTP 200 status and presents a page titled 'IG Clone,' directly indicating an Instagram-themed fraud attempt. The SSL certificate is issued by Google Trust Services (WR1), a common feature in phishing campaigns leveraging legitimate CDN providers to evade initial scrutiny. Infrastructure analysis reveals the domain is registered through Vercel, a platform frequently abused for rapid phishing deployment due to its free hosting and automatic SSL provisioning. The site appears on one security blocklist and is blocked by PhishDestroy, with 17 of 91 security vendors on VirusTotal flagging it as malicious. No additional brand impersonation details or phishing kit signatures are currently available, but the page title and hosting context strongly suggest a credential harvesting operation. Defenders should treat this domain as high-risk. Recommended actions include immediate blocking at DNS and proxy levels, monitoring for related subdomains or newly registered Vercel-hosted domains with similar naming patterns, and alerting users to potential Instagram credential theft attempts. Further analysis of the site's backend or redirect chains may reveal additional infrastructure or campaign linkages, though no such data is presently available.