spotify-clone-mustr[.]netlify[.]app

The domain spotify-clone-mustr.netlify.app has been flagged by multiple phishing intelligence feeds. Both PhishDestroy and OpenPhish list the site as a phishing resource, and it currently appears on two public blocklists, confirming that at least two independent vendors have observed malicious activity associated with the domain. Registration metadata shows the site was provisioned through Netlify, a cloud‑based hosting platform that provides automated DNS and static site deployment. DNS resolution returns the address 63.176.8.218, but the authoritative nameserver query returns NS_NOT_FOUND, indicating that the domain’s nameserver records are either missing or deliberately concealed. The IP belongs to Netlify’s infrastructure, which is commonly abused for short‑lived phishing pages because of its ease of deployment and built‑in TLS termination.

The domain’s status is reported as active, meaning the web service is still reachable. No public information is available regarding the HTTP response code, SSL certificate details, or page title, and the page content has not been captured in the current intelligence set. Consequently, the exact phishing payload, targeted brand, or credential‑harvesting technique cannot be confirmed at this time. The lack of visible nameserver data and the reliance on a shared hosting provider increase the difficulty of attributing the malicious actor, but the presence on two reputable blocklists provides sufficient confidence to treat the domain as a confirmed phishing infrastructure.

Defenders should immediately block traffic to spotify-clone-mustr.netlify.app at the network perimeter and add the resolved IP address 63.176.8.218 to any host‑based deny lists. Continuous monitoring of Netlify‑originating IP ranges is advised, as the provider’s dynamic allocation may host additional malicious sites.