instagram-clone-topaz-two[.]vercel[.]app

This domain is flagged as a high-risk brand impersonation threat targeting Google, designed to deceive users into disclosing sensitive credentials or personal information. The infrastructure mimics legitimate services, leveraging social engineering tactics to exploit trust in the targeted brand. Analysis indicates the domain is actively engaged in credential theft, a specific threat type distinct from generic phishing or malware distribution. Infrastructure analysis reveals the domain instagram-clone-topaz-two.vercel.app is registered through Vercel Inc. and resolves to the IP address 216.198.79.3, hosted on Amazon.com, Inc. (AS16509) infrastructure located in the United States. The page title displays 'Instagram,' suggesting an attempt to mislead users into believing the site is associated with Meta's platform, despite its primary impersonation of Google. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is flagged by 22 out of 95 security vendors on VirusTotal. SSL certification is provided by Google Trust Services (WR1), which may further obscure its malicious nature by presenting a seemingly legitimate encrypted connection. Mitigation against this brand impersonation threat requires immediate action from network defenders and end-users. Organizations should block the domain and its resolving IP (216.198.79.3) at the perimeter, leveraging firewall rules or DNS filtering to prevent access. End-users should be educated to scrutinize domain names, particularly those hosted on third-party platforms like Vercel, and verify SSL certificates for inconsistencies with the purported brand. Multi-factor authentication (MFA) should be enforced for all accounts to mitigate the impact of credential theft. Security teams are advised to monitor for similar domains using the seed '5580fe' in naming conventions, as this may indicate related malicious infrastructure.