cloneinstagram.now.sh
Category: Phishing
To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.
Quttera Web Malware Removal is a paid subscription service. Pricing, plans, and trial availability are set by Quttera. Quttera is operated by Quttera Ltd, an independent third-party company unrelated to RCS LT. PCrisk.com may earn a referral commission when users sign up through this link.
Description of cloneinstagram.now.sh
The domain cloneinstagram.now.sh appears to host a page styled to resemble Instagram, with the title "Instagram Clone" and a screenshot showing Instagram branding, a profile image, and account-related prompts in Portuguese. Based on the visible content, the page may be presenting itself as an Instagram-like login or account continuation interface rather than an independent social platform with its own branding.
The site is hosted on Vercel infrastructure and uses a subdomain under now.sh, which is commonly associated with deployed web projects and temporary or developer-hosted pages. The wording of the domain, combined with the page design, suggests it may have been created as a clone, imitation, or demonstration of Instagram's interface rather than an official property operated by Meta or Instagram.
No clear evidence in the provided data identifies a legitimate operator, company profile, or official affiliation. Based on the domain name and page presentation, the website appears to fall into a phishing or impersonation-related context rather than a standard social media service.
Safety Assessment for cloneinstagram.now.sh
Multiple scan signals indicate elevated risk at the time of this scan. The domain was flagged by 14 out of 91 security engines, with many of those detections classifying it as phishing or otherwise malicious. In addition, the page visually resembles Instagram and uses branding associated with that platform while being hosted on an unrelated subdomain, which may indicate an attempt to imitate a well-known service.
The malware scan produced only a generic suspicious finding on the main page and did not identify a named malware family, so that signal alone would be low confidence. However, in this case it is outweighed by the broader multi-engine phishing consensus and the page's apparent impersonation of a major social media brand. Although major threat databases listed in the scan were clean at the time and no DNS-based blocklist hits were reported, clean blacklist status does not negate the stronger phishing indicators.
The very low trust score, lack of ranking, and the page's account-login style presentation further increase concern. Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site was served over HTTPS with a valid TLS certificate issued by Google Trust Services, expiring in late 2026. It is hosted by Vercel on IP address 64.29.17.131, with Vercel nameservers configured. DNSSEC appears to be unsigned, which is common but means DNS responses do not benefit from DNSSEC validation.
From a hosting perspective, the infrastructure appears functional and modern, but valid HTTPS and reputable hosting do not by themselves establish legitimacy. A key technical concern is that the page is hosted on a generic deployment subdomain rather than an official Instagram-owned domain, while presenting branding that appears associated with Instagram.
Share your experience with this website. Was it safe? Did you encounter any issues?