instagram-nextjs-khushxxl[.]vercel[.]app

Analysis indicates that instagram-nextjs-khushxxl.vercel.app is an active brand impersonation domain targeting Instagram users. As of July 19, 2026, the domain remains operational with an HTTP 200 status, resolving to IP 64.29.17.67, hosted by Vercel, Inc. in the United States. The page title explicitly displays 'Instagram,' aligning with the reported scam type of brand impersonation. The domain appears on one security blocklist (PhishDestroy), and 18 of 91 security vendors on VirusTotal have flagged it as malicious. SSL certification is provided by Google Trust Services under the WR1 certificate. Infrastructure analysis reveals the domain was registered through Vercel, a platform commonly used for hosting both legitimate and malicious content. While the exact content of the page has not been analyzed, the combination of the page title, brand target, and scam classification strongly suggests an intent to deceive users into believing they are interacting with an official Instagram service. Defenders should treat this domain as high-risk and implement blocking measures at the network or endpoint level. Additional monitoring of Vercel-hosted subdomains with similar naming patterns (e.g., 'instagram-' prefixes) may help identify related threats. No further details about the phishing kit or user interaction flow are currently available.