spotify-web-player-clone[.]webflow[.]io

Analysis conducted on July 24, 2026 confirms that the domain spotify-web-player-clone.webflow.io is an active phishing site targeting Spotify user credentials. The domain is hosted on Webflow, Inc. infrastructure and currently resolves to the IP address 104.18.36.248, which is associated with Cloudflare's content delivery network. No nameserver records were identified during the investigation, which may indicate an incomplete or misconfigured DNS setup, though this does not impede the site's operational status. The domain appears on two security blocklists: PhishDestroy and OpenPhish, both of which specialize in real-time phishing threat intelligence. Additionally, VirusTotal reports that 12 out of 91 security vendors have flagged this domain as malicious, providing further evidence of its phishing classification.

The detection count, while not exhaustive, aligns with typical phishing domain profiles observed in credential theft campaigns. Infrastructure analysis reveals that the domain is registered through Webflow, a legitimate platform commonly used for web development, which may explain its apparent legitimacy to unsuspecting users. The use of a subdomain under webflow.io could also be an attempt to exploit trust in the Webflow brand. The domain's current status remains active, and no takedown actions have been recorded as of the report date.

The exact content of the phishing page has not yet been analyzed, but the domain name strongly suggests an intent to mimic the Spotify web player interface for credential harvesting. Defenders are advised to block the domain at the network level and update endpoint protection rules to include this indicator. Organizations should also monitor for authentication attempts originating from this domain and consider resetting credentials for any accounts that may have interacted with it.