spotify-clone-sandy-delta[.]vercel[.]app

This domain, spotify-clone-sandy-delta.vercel.app, is flagged as a high-risk phishing site impersonating Spotify. Analysis indicates it presents a fraudulent login interface under the page title 'Sushh Spotify,' designed to harvest user credentials. The threat type is classified as brand impersonation with credential theft objectives, lacking evidence of cryptocurrency drainer functionality or associated malware payloads. Infrastructure analysis reveals the domain resolves to IP address 64.29.17.3, hosted by Vercel Inc. in the United States. The SSL certificate is issued by Google Trust Services (WR1), and the domain appears on one security blocklist. VirusTotal detection shows 16 out of 95 security vendors flagging the domain as malicious. Registration details confirm Vercel Inc. as the registrar, though exact creation date remains unconfirmed in available telemetry. Google Safe Browsing status is not explicitly listed in current intelligence. The domain remains active as of the latest verification, with no evidence of takedown or suspension. Response actions should include immediate blacklisting in enterprise security controls, DNS sinkholing, and endpoint protection rules targeting the IP and domain. Remaining risk is classified as high due to active credential harvesting infrastructure and low detection coverage among security vendors. Organizations are advised to monitor network traffic for connections to 64.29.17.3 and implement user awareness training regarding Spotify brand impersonation threats.