instagram-clone-kappa-five[.]vercel[.]app

This domain instagram-clone-kappa-five.vercel.app is currently active and flagged for brand impersonation targeting Instagram. It presents a page titled Instagram Clone and resolves to IP address 64.29.17.131 hosted by Vercel Inc. in the United States. Multiple indicators confirm the malicious classification including a Google Safe Browsing SOCIAL_ENGINEERING flag, detection by PhishDestroy, and listing on one security blocklist. The domain was created on April 28 2026 and returns HTTP status 200 with an SSL certificate issued by Google Trust Services under the WR1 profile. Analysis indicates the infrastructure uses Vercel and HSTS technologies while nameserver records are absent.

VirusTotal reports 22 out of 95 vendors detecting the domain. Scamadviser assigns a trust score of 1 out of 100 and Gridinsoft assigns 0 out of 100. The page explicitly impersonates Instagram and is categorized as credential phishing. Infrastructure analysis reveals the domain remains operational as of July 12 2026 with no indication of takedown. The combination of low trust scores and explicit social engineering flags provides concrete evidence of active abuse rather than benign development activity.

Certain details remain undetermined such as the precise operator identity or the full extent of any associated campaign infrastructure. The absence of nameserver data limits further passive reconnaissance while the single blocklist appearance suggests detection coverage is incomplete. No additional ASN or kit fingerprints are recorded in available intelligence.

Defenders should block the domain and IP 64.29.17.131 at network and endpoint controls. Organizations protecting Instagram users are advised to monitor for similar vercel.app subdomains and to update credential harvesting signatures with the observed page title and certificate details. Continued observation of the domain status is recommended given its current active state.