instagram-clone-eta-three[.]vercel[.]app

This domain, instagram-clone-eta-three.vercel.app, poses a high-risk brand impersonation threat targeting Instagram users. The site presents itself as a legitimate Instagram interface, likely designed to harvest login credentials or distribute malicious payloads. Visitors may be tricked into entering sensitive information, which could lead to account compromise, unauthorized access, or further exploitation through social engineering tactics. The page title explicitly reads 'Instagram Clone,' confirming its deceptive intent to replicate the official platform's appearance and functionality.

Analysis indicates the domain was registered through Vercel Inc. and resolves to the IP address 216.198.79.131, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509). The domain was created on February 27, 2026, though its premature registration date suggests potential obfuscation or misconfiguration. VirusTotal reports 20 out of 95 security vendors flagging this domain as malicious, with detections spanning phishing, brand impersonation, and fraud categories. Additionally, the domain appears on one security blocklist and is currently marked as active, with no signs of takedown or remediation.

If you or someone in your network has visited instagram-clone-eta-three.vercel.app, immediate action is required. Disconnect the affected device from the network to prevent potential lateral movement or data exfiltration. Reset credentials for any accounts accessed while the site was open, prioritizing email and financial services linked to the compromised account. Enable multi-factor authentication where available and monitor for unusual activity, such as unauthorized logins or transactions. Report the incident to your organization's security team or a trusted incident response provider for further analysis, including log review and potential IOC (Indicator of Compromise) extraction.