instagram-copy[.]vercel[.]app

The domain instagram-copy.vercel.app is currently active and confirmed as a brand impersonation site specifically targeting Instagram users. Analysis indicates this is a credential harvesting operation designed to mimic the official Instagram login interface, as evidenced by the page title 'Instagram' and the domain's naming convention. The infrastructure is hosted on a platform known for rapid deployment, which is frequently exploited for phishing campaigns. Infrastructure analysis reveals the domain was registered on May 9, 2026, through Vercel, resolving to the IP address 64.29.17.131 located in the United States. The site is flagged by 19 of 95 security vendors on VirusTotal, indicating a high level of detection across multiple threat intelligence sources. It appears on one security blocklist and is currently blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services (WR1), which, while legitimate, does not mitigate the malicious intent of the domain. The creation date suggests the domain may have been pre-registered for malicious use, a common tactic to evade detection. As of the latest assessment, instagram-copy.vercel.app remains active and continues to pose a significant risk to users. Organizations and individuals are advised to block the domain at the network level and update endpoint protection rules to include this indicator of compromise. Users who may have interacted with the site should immediately reset their credentials using multi-factor authentication and monitor their accounts for unauthorized activity. Security teams should treat this domain as a high-priority threat and include it in threat hunting activities to identify potential breaches.