spotify-clone-website-using-html-css[.]netlify[.]app

Analysis of spotify-clone-website-using-html-css.netlify.app shows a high‑risk generic phishing infrastructure that remains active as of July 24, 2026. The domain is hosted on Netlify, a provider that offers static site hosting, and the registration details list Netlify as the registrar. No authoritative nameserver information was returned (NS_NOT_FOUND), indicating that typical DNS queries do not expose a conventional NS record set. The domain resolves to the IP address 35.157.26.135, an address belonging to the Amazon Web Services (AWS) network commonly used by Netlify customers.

Two independent phishing‑focused blocklists, PhishDestroy and OpenPhish, have already added the domain to their deny lists, confirming that security vendors have observed malicious activity tied to this host. VirusTotal scans show that 14 of 91 security engines flagged the domain, reinforcing the suspicion of malicious intent. Additionally, the domain appears on two broader security blocklists, which further corroborates its classification as a phishing site.

No public page title, SSL certificate details, or HTTP response codes have been disclosed, leaving the exact content of the site unverified in this report. Defenders should therefore treat any traffic to this domain as hostile: block the domain at the DNS resolver level, add the IP address 35.157.26.135 to network‑level deny lists, and ensure that endpoint protection solutions incorporate the two blocklist identifiers (PhishDestroy, OpenPhish) along with the VirusTotal detection count. Continuous monitoring of Netlify‑hosted assets and the associated AWS IP range is recommended to detect any pivot or re‑use of the infrastructure for future campaigns.