instagram-clone-iota-three[.]vercel[.]app

This domain is flagged as a high-risk fake login phishing site targeting Instagram credentials. Analysis indicates the page mimics legitimate authentication interfaces to harvest user account details, a common tactic in credential theft campaigns. The domain operates under the guise of an Instagram clone, increasing the likelihood of successful deception against unsuspecting users. Infrastructure analysis reveals the following technical indicators: the domain instagram-clone-iota-three.vercel.app is registered through Vercel Inc. and resolves to the IP address 216.198.79.3, hosted in the United States under Lefkoff Industries. The SSL certificate is issued by Google Trust Services (WR1), a legitimate provider often exploited by threat actors to lend false credibility. The domain was created on April 28, 2026, and remains active despite being flagged by 20 out of 95 security vendors on VirusTotal. It appears on at least one security blocklist, specifically PhishDestroy, further corroborating its malicious classification. Mitigation steps for this specific threat type include immediate blocking of the domain and its resolving IP address at the network perimeter. Organizations should deploy email and web filtering rules to prevent users from accessing the site. End-users should be educated on identifying fake login pages, particularly those hosted on third-party platforms like Vercel, which may not match the expected domain structure of the impersonated brand. If credentials were entered on this site, affected accounts must be secured immediately by resetting passwords and enabling multi-factor authentication. Network logs should be reviewed for connections to 216.198.79.3 to identify potential compromise.