instagram-clone-khaki-phi[.]vercel[.]app

This domain, instagram-clone-khaki-phi.vercel.app, was created on 27 February 2026 and is currently active. DNS resolution points to IP 216.198.79.3, hosted within AS16509 (Amazon.com, Inc.) in the United States. The domain is registered through Vercel Inc. and uses Vercel‑provided nameservers ns1‑ns4.vercel-dns-3.com. An SSL certificate issued by Google Trust Services under the WR1 identifier is presented, which may lend false legitimacy. The site returns HTTP 200 and displays the page title “Instagram Clone”. Intelligence indicates the content is intended to impersonate Google and is classified as a tech‑support scam. Reputation services assign extremely low trust scores (Gridinsoft 0/100, Scamadviser 1/100). VirusTotal analysis shows 20 of 93 scanners flag the domain, and it is listed on the PhishDestroy blocklist. The high‑risk rating reflects the combination of brand impersonation, low trust scores, and multiple vendor detections. Current uncertainties include the exact payload delivered to victims and whether additional infrastructure (e.g., command‑and‑control servers) is associated with the IP. Defenders should block the domain and its resolved IP at network perimeters, monitor DNS queries for the domain and related Vercel name servers, and consider adding the host to endpoint detection rules. Continuous re‑evaluation is advised as further indicators may emerge.