Spotify

Streaming & media Swedenspotify.comRank 17 of the most impersonated
Cert findings · 24 h
3
Cert findings · 7 days
8
4 reported or listed · 4 on phishing hosts
Registered lookalikes
128
12 listed by a source or an address list
Official domains
15
verified from Spotify's own sites and records

Certificate findings for Spotify

Updated hourly · 2026-11-05 10:53 UTC

DomainSpoof matched these hostnames, from public certificate logs, to Spotify's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.

Published now · 10 findings, grouped by hostname

  1. spotify.one NL · AS60781 · LEASEWEB-NL-AMS-01 LeaseWeb…2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 8 y ago
    DetailsHide
    Hostname
    spotify.one
    First seen
    2026-11-05 09:02 UTC
    DNS
    Resolves · checked 2026-11-05 09:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 37.48.77.81.
    1. Phishing-host list fetched with the address
    2. Resolved to 37.48.77.81
    Brand
    Spotify
    Addresses
    37.48.77.81 · Netherlands · AS60781 LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.
    192.157.56.140 · Canada · AS55286 SERVER-MANIA - B2 Net Solutions Inc.
    Domain
    spotify.one
    Registered
    2019-02-25 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:36 UTC

    Suggest a correction

  2. spotify.cm US · AS46475 · Limestone Networks, Inc.2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 9 y ago
    DetailsHide
    Hostname
    spotify.cm
    First seen
    2026-11-05 09:02 UTC
    First published
    2026-10-28 05:36 UTC
    DNS
    Resolves · checked 2026-11-05 09:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 69.162.80.59.
    1. Phishing-host list fetched with the address
    2. Resolved to 69.162.80.59
    Brand
    Spotify
    Addresses
    69.162.80.59 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.
    69.162.80.51 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.
    Domain
    spotify.cm
    Registered
    2018-01-18 · Netcom.cm Sarl
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  3. spotishop.ir IR · AS205585 · ARVANCLOUD-CDN-IR Noyan Abr…2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    spotishop.ir
    First seen
    2026-11-05 00:24 UTC
    First published
    2026-11-05 00:41 UTC
    DNS
    Resolves · checked 2026-11-05 00:49 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.143.233.133.
    1. Certificate logged in CT
    2. Resolved to 185.143.233.133
    3. Phishing-host list fetched with the address
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-04 23:18 UTC to 2027-02-02 23:18 UTC
    Logged 2026-11-05 00:16 UTC in Let's Encrypt Sycamore2027h1, entry 949,964,099
    SHA-256 6dfe15c5d0e76b5a3e644d718040b8dcc01581fe671ee15317ef2cb111144b71
    Public key SHA-256 50c8d53363d9cfdd049d4e6a8a8a8c6f85048abb771a4a7154921899272c18b8
    Brand
    Spotify
    Addresses
    185.143.233.133 · Iran · AS205585 ARVANCLOUD-CDN-IR Noyan Abr Arvan Co. ( Private Joint Stock)
    185.143.234.133 · Iran · AS205585 ARVANCLOUD-CDN-IR Noyan Abr Arvan Co. ( Private Joint Stock)
    Domain
    spotishop.ir
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:28 UTC

    Suggest a correction

  4. membership-spotify-premium.me US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 11 d ago
    DetailsHide
    Hostname
    membership-spotify-premium.me
    First seen
    2026-11-02 16:05 UTC
    First published
    2026-11-02 16:54 UTC
    Listing
    CERT Polska listed it 2026-10-30 · still listed at the last successful feed check 2026-11-05 09:17 UTC
    DNS
    Resolves · checked 2026-11-04 16:58 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-02 15:06 UTC to 2027-01-31 15:06 UTC
    Logged 2026-11-02 16:04 UTC in IPng Networks Halloumi2027h1, entry 339,682,367
    SHA-256 4ad93341935e6dbc9694c4b2abd847bbcb881c6964e508435f8444ff15f7a131
    Public key SHA-256 9eeff85f5d6472f37d1eb1c6ba8b81eb2bf98db72b68bfdd2658c00e32401b28
    Brand
    Spotify
    Addresses
    104.21.5.134 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.133.125 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3033::ac43:857d
    2606:4700:3036::6815:586
    Cloudflare
    Cloudflare (104.21.5.134, 172.67.133.125): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    membership-spotify-premium.me
    Registered
    2026-10-25 · Eranet International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 17:09 UTC

    Suggest a correction

  5. spotify.spotifull.com US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareUnder spotifull.com, reported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 15 mo ago
    DetailsHide
    Hostname
    spotify.spotifull.com
    First seen
    2026-11-01 02:05 UTC
    First published
    2026-11-01 02:59 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 03:12 UTC
    Reported
    PhishDestroy, listing spotifull.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-01 01:05 UTC to 2027-01-30 01:05 UTC
    Logged 2026-11-01 02:04 UTC in Google ParcelYard2027h1, entry 548,645,223
    SHA-256 28cf6ae5fcb905587b4ca95e512cfefb03628bcae2a065336d4b826a787cda36
    Public key SHA-256 9d95574c057602341d9eea2e29ed87cfef0ca91f17b6d4cde5ba436d792752ff
    PhishDestroy
    Brand
    Spotify
    Addresses
    104.21.44.242 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.205.70 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3030::ac43:cd46
    2606:4700:3037::6815:2cf2
    Cloudflare
    Cloudflare (104.21.44.242, 172.67.205.70): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    spotifull.com
    Registered
    2025-08-07 · OVH sas
    MX
    Receives mail at route2.mx.cloudflare.net, route1.mx.cloudflare.net, route3.mx.cloudflare.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:54 UTC

    Suggest a correction

  6. spotify-payment.click US · AS396982 · Google LLC2 addresses
    ReportedGoogle CloudReported by PhishDestroyMX presentSPF missingDMARC missingRegistered 9 mo ago
    DetailsHide
    Hostname
    spotify-payment.click
    First seen
    2026-10-30 16:16 UTC
    First published
    2026-10-30 17:03 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishTank: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 09:46 UTC
    DNS
    Resolves · checked 2026-11-04 17:12 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by ZeroSSL ECC DV SSL CA 2
    Valid 2026-10-30 00:00 UTC to 2027-01-28 23:59 UTC
    Logged 2026-10-30 16:09 UTC in Let's Encrypt Sycamore2027h1, entry 858,133,036
    SHA-256 0aa2a39a12f8ca13b7ce6513750d0d7db432220c006335105ecb4130800f066f
    Public key SHA-256 828f64b522d3f991958d051e222a516b68c9462ce17c4f85e0929b327ee2419c
    PhishDestroy
    Brand
    Spotify
    Addresses
    34.76.205.124 · United States · AS396982 GOOGLE-CLOUD-PLATFORM - Google LLC · Google Cloud (cloud provider)
    2600:1901:0:51b9::
    Google Cloud
    Google Cloud (34.76.205.124): a cloud provider. It rents servers and addresses to its customers.
    Domain
    spotify-payment.click
    Registered
    2026-02-14 · Sav.com, LLC
    MX
    Receives mail at mx.all-harmless.domains
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  7. cdn.spoties.se SE · AS39570 · LOOPIA Loopia AB
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC policy none
    DetailsHide
    Hostname
    cdn.spoties.se
    First seen
    2026-10-30 03:16 UTC
    First published
    2026-10-30 03:51 UTC
    DNS
    Resolves · checked 2026-11-05 04:01 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 93.188.2.55.
    1. Resolved to 93.188.2.55
    2. Phishing-host list fetched with the address
    3. Latest DNS check
    Brand
    Spotify
    Addresses
    93.188.2.55 · Sweden · AS39570 LOOPIA Loopia AB
    Domain
    spoties.se
    MX
    Receives mail at mailcluster.loopia.se, mail2.loopia.se
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 06:44 UTC

    Suggest a correction

  8. file.spotify.org.in US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareUnder spotify.org.in, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    file.spotify.org.in
    First seen
    2026-10-29 19:06 UTC
    First published
    2026-10-29 19:32 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 19:44 UTC
    Listed
    MetaMask, listing spotify.org.in and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-10-29 18:05 UTC to 2027-01-27 18:05 UTC
    Logged 2026-10-29 19:04 UTC in DigiCert Sphinx2027h1, entry 309,357,394
    SHA-256 c6431b1974adff21275601be373290d1cadb14ff0079d2843e18df395891638a
    Public key SHA-256 de52a6d8cbf6db2ec10e351cf8706314ab0238d587b0898cccc453a8da18dd1c
    Brand
    Spotify
    Addresses
    104.21.74.225 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.164.13 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3033::ac43:a40d
    2606:4700:3037::6815:4ae1
    Cloudflare
    Cloudflare (104.21.74.225, 172.67.164.13): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    spotify.org.in
    Registered
    2025-12-05 · Hosting Concepts B.V. dba Openprovider
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 20:39 UTC

    Suggest a correction

  9. www.subscription-spotify.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ReportedParking page · ParkingCrew (Team Internet)Under subscription-spotify.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    www.subscription-spotify.com
    First seen
    2026-10-28 22:21 UTC
    First published
    2026-10-28 22:27 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 22:41 UTC
    Reported
    PhishDestroy, listing subscription-spotify.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-28 21:18 UTC to 2027-01-26 21:18 UTC
    Logged 2026-10-28 22:17 UTC in Let's Encrypt Sycamore2027h1, entry 827,878,304
    SHA-256 7b6b8711c88ad9b0e04e22a6257958d17eab2ae72bd69bad59f5b309a758a663
    Public key SHA-256 b351b3bd6129e4ac17d8f0bd8976d9d35956260c745850993449ac2464caed78
    PhishDestroy
    Brand
    Spotify
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    subscription-spotify.com
    Registered
    2026-06-14 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 10:04 UTC

    Suggest a correction

  10. subscription-spotify.com US · AS214036 · ULTAHOST-AS Ultahost, Inc.
    ReportedReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    subscription-spotify.com
    First seen
    2026-10-28 06:16 UTC
    First published
    2026-10-28 06:38 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-10-28 05:11 UTC to 2027-01-26 05:11 UTC
    Logged 2026-10-28 06:10 UTC in Let's Encrypt Sycamore2027h1, entry 815,374,794
    SHA-256 21ea0191b2343a54068ba067f409003e268c0b3cb63e7c9939565978f1cab4e0
    Public key SHA-256 b351b3bd6129e4ac17d8f0bd8976d9d35956260c745850993449ac2464caed78
    PhishDestroy
    Brand
    Spotify
    Addresses
    212.224.107.10 · United States · AS214036 ULTAHOST-AS Ultahost, Inc.
    Domain
    subscription-spotify.com
    Registered
    2026-06-14 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 10:04 UTC

    Suggest a correction

How certificate findings are selected

Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.

DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches Spotify when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

More brands in Streaming & media

All brands →