spotify-clone-player[.]vercel[.]app

Analysis of spotify-clone-player.vercel.app shows a newly registered site (created 28 Feb 2026) that mimics Spotify’s branding. The page title "Spotify Player" and the use of the Spotify name indicate a brand-impersonation campaign aimed at streaming-related fraud. The domain is listed on one public blocklist and is actively flagged by PhishDestroy. Infrastructure analysis reveals the site is hosted on Vercel’s platform. DNS resolves to 216.198.79.131, an address owned by Amazon.com, Inc. (AS16509) and located in the United States. The server presents an SSL certificate issued by Google Trust Services under the WR1 designation and enforces HTTP Strict Transport Security, confirming a legitimate TLS configuration despite the malicious intent. Security telemetry shows 21 of 95 VirusTotal scanners raise detections, and reputation services assign a Scamadviser trust score of 1/100 and a Gridinsoft score of 0/100, reinforcing the high‑risk classification. No additional payloads or redirect chains have been observed beyond the initial landing page, leaving the exact malicious behavior (e.g., credential harvesting or ad‑injection) uncertain. Defenders should block the domain at the network perimeter and add it to URL filtering lists. Endpoint security solutions ought to flag any process that attempts to load resources from this host. Continuous monitoring of DNS queries for the four Vercel name servers can help detect future clones using the same infrastructure. Incident response teams should treat any user‑reported interaction with the site as a potential compromise and advise immediate credential reset for the targeted Spotify account.