spotifyclone-weld[.]vercel[.]app

The domain spotifyclone-weld.vercel.app was registered on February 21, 2026 through Tucows Domains Inc. and is hosted on the Vercel platform, as indicated by the detected Vercel technology stack and the presence of HTTP Strict Transport Security (HSTS). The site resolves to IP address 64.29.17.67, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. SSL certification is provided by Google Trust Services under the WR1 certificate, confirming that the connection was encrypted when the domain was active.

The HTTP response returned a 451 status code, and the page title displayed "Deployment Unavailable," suggesting the service has been taken offline. Google Safe Browsing classifies the domain as social engineering, and VirusTotal reports that 16 of 93 security vendors have flagged the domain as malicious. It appears on a single external security blocklist and is listed by PhishDestroy as a blocked entity.

While the exact phishing payload or credential‑harvesting page has not been captured, the combination of a recent registration, use of a reputable hosting provider, and multiple vendor detections supports a high confidence assessment of a generic phishing operation. Defenders should add spotifyclone-weld.vercel.app and its resolving IP 64.29.17.67 to firewall and DNS block lists, monitor for any resurgence of the Vercel deployment, and review inbound traffic for attempts to access the domain. Ongoing surveillance of related Vercel accounts and rapid takedown requests to the registrar are recommended to mitigate any future abuse.