instagram-clone-ruby-ten[.]vercel[.]app

This domain, instagram-clone-ruby-ten.vercel.app, operates as a fake login portal designed to harvest user credentials by impersonating the Instagram platform. Analysis indicates the site presents a visually identical interface to the legitimate service, tricking visitors into entering sensitive account details. The threat primarily targets users expecting to access Instagram, potentially leading to account compromise, unauthorized access, or further social engineering attacks using stolen credentials. Infrastructure analysis reveals the domain is registered through Vercel Inc. and resolves to the IP address 64.29.17.3, located within Amazon.com, Inc.'s AS16509 network in the United States. The site is flagged by 19 out of 95 security vendors on VirusTotal, indicating a high confidence level in its malicious nature. Additionally, it appears on two security blocklists, PhishDestroy and PhishingDB, further corroborating its classification as a phishing threat. The SSL certificate, issued by Google Trust Services (WR1), does not mitigate the risk, as phishing sites commonly use valid certificates to appear legitimate. Users who visited instagram-clone-ruby-ten.vercel.app should immediately cease all interaction with the site and assume any entered credentials have been compromised. The first step is to change passwords for Instagram and any other accounts where identical credentials may have been reused. Enable multi-factor authentication on all critical accounts to prevent unauthorized access. Monitor linked email accounts for suspicious login attempts or password reset requests, as these may indicate follow-up attacks. If financial or personally identifiable information was entered, consider reporting the incident to relevant authorities and credit monitoring services to mitigate potential identity theft risks. The domain is currently offline, but users should remain vigilant for similar threats hosted on other platforms.