# PhishDestroy domain threat record: autoconfig.no-spotify.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/autoconfig.no-spotify.com/
Machine-readable companion: https://phishdestroy.io/domain/autoconfig.no-spotify.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-22 05:18:09 UTC
- Stored record updated: 2026-10-22 08:55:24 UTC
- VirusTotal detections in the stored snapshot: 14/92
- Independent public blocklist matches in the stored snapshot: 1
- Matching public blocklists: Phishunt
- Google Safe Browsing stored result: flagged

## Stored classification

- Targeted brand: spotify

## Stored infrastructure

- Observed IP address: 198.54.132.28
- Registrar in stored WHOIS data: Ultahost, Inc.
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-10-06 22:17:09 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a146d5-217d-776c-bb3e-a74ba77f8596/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/autoconfig.no-spotify.com
- Certificate Transparency search: https://crt.sh/?q=%25.autoconfig.no-spotify.com
- Web Archive lookup: https://web.archive.org/web/*/https://autoconfig.no-spotify.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added autoconfig.no-spotify.com to its internal blocklist on 2026-10-22 following Google Safe Browsing’s SOCIAL_ENGINEERING alert. A request on the same day returned HTTP 200 with an XML content type; no page title was recorded.

How the scam works
The listing reflects a generic risk of deceptive pages that may mimic legitimate services to solicit user actions. Because the recorded page contained only XML and no visible content, no specific lure or mechanism can be confirmed from this observation.

Evidence
VirusTotal reported 14 detections (12 malicious, 2 suspicious) from 92 engines on 2026-10-14, retrieved 2026-10-22. Google Safe Browsing flagged the domain for SOCIAL_ENGINEERING on 2026-10-22. urlscan.io’s automated analysis tagged the URL as malicious with a score of 62 while its overall verdict remained clean; Cloudflare Radar labeled the domain as malicious phishing on 2026-10-22. The external blocklist Phishunt and PhishDestroy’s internal list both include the domain.

Infrastructure
The domain was nine days old at first observation and presented a Let’s Encrypt TLS certificate issued 2026-10-07, valid until 2027-01-05. The recorded IP was 198.54.132.28, associated with tzulo, inc. in Canada, and the server identified itself as LiteSpeed with HTTP/3 support.

What to do
Do not submit any information on this site; if you have already done so, change any reused passwords and enable multi-factor authentication where available. Defenders should block the domain and review logs for requests to autoconfig.no-spotify.com.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a146d5-217d-776c-bb3e-a74ba77f8596/
Cloudflare Radar report: https://radar.cloudflare.com/scan/21c9b87c-defa-4b12-94f3-20a14db2a72a
Stored capture screenshot: https://urlscan.io/screenshots/01a146d5-217d-776c-bb3e-a74ba77f8596.png
Cloudflare Radar screenshot (2026-10-22T05:21:54Z): https://screenshots.phishdestroy.io/cf/21c9b87c-defa-4b12-94f3-20a14db2a72a.png
URLScan screenshot (2026-10-14T14:45:37Z): https://screenshots.phishdestroy.io/us/01a13ae0-2754-71bb-a5bc-256d28cd709e.png
URLScan capture report: https://urlscan.io/result/01a13ae0-2754-71bb-a5bc-256d28cd709e/
URLScan screenshot (2026-10-14T18:43:17Z): https://screenshots.phishdestroy.io/us/01a13bb9-c0f1-74da-a22e-1563bd3c1eff.png
URLScan capture report: https://urlscan.io/result/01a13bb9-c0f1-74da-a22e-1563bd3c1eff/
URLScan screenshot (2026-10-14T18:43:58Z): https://screenshots.phishdestroy.io/us/01a13bba-5c71-76d3-9cd0-f5a09b4a330e.png
URLScan capture report: https://urlscan.io/result/01a13bba-5c71-76d3-9cd0-f5a09b4a330e/
URLScan screenshot (2026-10-16T01:03:26Z): https://screenshots.phishdestroy.io/us/01a1423c-2702-7611-a4f3-e2c950976300.png
URLScan capture report: https://urlscan.io/result/01a1423c-2702-7611-a4f3-e2c950976300/
URLScan screenshot (2026-10-16T09:59:51Z): https://screenshots.phishdestroy.io/us/01a14427-3e6b-72e8-b7a9-4809bde1bf14.png
URLScan capture report: https://urlscan.io/result/01a14427-3e6b-72e8-b7a9-4809bde1bf14/
URLScan screenshot (2026-10-16T20:26:50Z): https://screenshots.phishdestroy.io/us/01a14665-406c-714a-8587-329dfbdb5424.png
URLScan capture report: https://urlscan.io/result/01a14665-406c-714a-8587-329dfbdb5424/
VirusTotal report: https://www.virustotal.com/gui/domain/autoconfig.no-spotify.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=autoconfig.no-spotify.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-22 05:53:50 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a146d5-217d-776c-bb3e-a74ba77f8596.png
  Captured: 2026-10-22 05:18:09 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a146d5-217d-776c-bb3e-a74ba77f8596.png
  Source report: https://urlscan.io/result/01a146d5-217d-776c-bb3e-a74ba77f8596/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/21c9b87c-defa-4b12-94f3-20a14db2a72a.png
  Captured: 2026-10-22 05:21:54 UTC
  Source report: https://radar.cloudflare.com/scan/21c9b87c-defa-4b12-94f3-20a14db2a72a
  SHA-256: 6fe34e3a7284e04df6773163055b194f34610f307b7e0dc3c1971101f43c1709
- URLScan · 2026-10-14: https://screenshots.phishdestroy.io/us/01a13ae0-2754-71bb-a5bc-256d28cd709e.png
  Captured: 2026-10-14 14:45:37 UTC
  Source report: https://urlscan.io/result/01a13ae0-2754-71bb-a5bc-256d28cd709e/
  SHA-256: a6430a01297336660bd4f7db8022081d118fdf84bf9c8b3d8347af4f6a7593bc
- URLScan · 2026-10-14: https://screenshots.phishdestroy.io/us/01a13bb9-c0f1-74da-a22e-1563bd3c1eff.png
  Captured: 2026-10-14 18:43:17 UTC
  Source report: https://urlscan.io/result/01a13bb9-c0f1-74da-a22e-1563bd3c1eff/
  SHA-256: a6430a01297336660bd4f7db8022081d118fdf84bf9c8b3d8347af4f6a7593bc
- URLScan · 2026-10-14: https://screenshots.phishdestroy.io/us/01a13bba-5c71-76d3-9cd0-f5a09b4a330e.png
  Captured: 2026-10-14 18:43:58 UTC
  Source report: https://urlscan.io/result/01a13bba-5c71-76d3-9cd0-f5a09b4a330e/
  SHA-256: a6430a01297336660bd4f7db8022081d118fdf84bf9c8b3d8347af4f6a7593bc
- URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a1423c-2702-7611-a4f3-e2c950976300.png
  Captured: 2026-10-16 01:03:26 UTC
  Source report: https://urlscan.io/result/01a1423c-2702-7611-a4f3-e2c950976300/
  SHA-256: a6430a01297336660bd4f7db8022081d118fdf84bf9c8b3d8347af4f6a7593bc
- URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a14427-3e6b-72e8-b7a9-4809bde1bf14.png
  Captured: 2026-10-16 09:59:51 UTC
  Source report: https://urlscan.io/result/01a14427-3e6b-72e8-b7a9-4809bde1bf14/
  SHA-256: a6430a01297336660bd4f7db8022081d118fdf84bf9c8b3d8347af4f6a7593bc
- URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a14665-406c-714a-8587-329dfbdb5424.png
  Captured: 2026-10-16 20:26:50 UTC
  Source report: https://urlscan.io/result/01a14665-406c-714a-8587-329dfbdb5424/
  SHA-256: a6430a01297336660bd4f7db8022081d118fdf84bf9c8b3d8347af4f6a7593bc

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-22T05:25:13Z",
        "uuid": "01a146d5-217d-776c-bb3e-a74ba77f8596",
        "scanned_at": "2026-10-16T22:29:00Z",
        "final_url": "https://autoconfig.no-spotify.com/",
        "status": 200,
        "ip": "198.54.132.28",
        "ptr": "static-198-54-132-28.cust.tzulo.com",
        "ips": [
            "198.54.132.28"
        ],
        "asns": [
            "11878"
        ],
        "countries": [
            "CA"
        ],
        "doc_hash": "bc5557d26f9090c90f85341c659bb49e82bc2fbfffaf8cc05f609da33328ba90",
        "tls": {
            "san": [
                "autoconfig.no-spotify.com",
                "autodiscover.no-spotify.com",
                "cpanel.no-spotify.com",
                "cpcalendars.no-spotify.com",
                "cpcontacts.no-spotify.com",
                "mail.no-spotify.com",
                "no-spotify.com",
                "webdisk.no-spotify.com",
                "webmail.no-spotify.com",
                "www.no-spotify.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR1",
            "subject": "no-spotify.com",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-05T01:02:39Z",
            "valid_from": "2026-10-07T01:02:40Z"
        },
        "domain_age_days": 9,
        "apex_age_days": 9,
        "tls_age_days": 9,
        "tls_valid_days": 89,
        "requests": 3,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 62,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "LiteSpeed",
            "content-type": "application/xml"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-22T05:25:15Z",
        "uuid": "21c9b87c-defa-4b12-94f3-20a14db2a72a",
        "scanned_at": "2026-10-22T05:21:54Z",
        "final_url": "https://autoconfig.no-spotify.com/",
        "status": 200,
        "history": [
            {
                "url": "https://autoconfig.no-spotify.com/",
                "status": 200
            }
        ],
        "dom_hash": "963fc2c0462153307ef60d4b812223716a0979e59f14ece9366dd6f571298589",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "autoconfig.no-spotify.com",
                "type": "A",
                "value": "198.54.132.28"
            }
        ],
        "dnssec_valid": false,
        "ip": "198.54.132.28",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "Ultahost, Inc.",
            "created": "2026-10-07T00:17:09Z",
            "updated": "2026-10-07T00:17:09Z",
            "expires": "2027-10-07T00:17:09Z",
            "nameservers": [
                "ns1.ultahost.com",
                "ns2.ultahost.com",
                "ns3.ultahost.com",
                "ns4.ultahost.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T05:51:33Z",
        "analysis_at": "2026-10-14T19:41:21Z",
        "stats": {
            "timeout": 0,
            "harmless": 46,
            "malicious": 12,
            "suspicious": 2,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "phishing",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "phishing",
            "alphaMountain.ai": "phishing",
            "Google Safe Browsing": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "Ultahost, Inc.",
        "created": "2026-10-07T00:17:09Z",
        "expires": "2027-10-07T00:17:09Z",
        "updated": "2026-10-07T00:17:09Z",
        "first_seen": "2026-10-07T17:41:14Z",
        "dns": [
            {
                "ttl": 14400,
                "type": "A",
                "value": "198.54.132.28"
            }
        ],
        "dns_at": "2026-10-14T19:46:47Z",
        "jarm": "29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae",
        "cert": {
            "san": [
                "autoconfig.no-spotify.com",
                "autodiscover.no-spotify.com",
                "cpanel.no-spotify.com",
                "cpcalendars.no-spotify.com",
                "cpcontacts.no-spotify.com",
                "mail.no-spotify.com",
                "no-spotify.com",
                "webdisk.no-spotify.com",
                "webmail.no-spotify.com",
                "www.no-spotify.com"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "59e4ef6e33843319505a87cf4ed5960b804",
            "sha256": "e9afe2d0afc7fb558c6711045223a84f2bd38760a4368ba5ca42a7fda92f4000",
            "subject": "no-spotify.com",
            "valid_to": "2027-01-05T01:02:39Z",
            "valid_from": "2026-10-07T01:02:40Z"
        },
        "whois": {
            "registrar": "Ultahost, Inc.",
            "registrar_iana_id": "4331",
            "registrar_url": "https://ultahost.com/",
            "created": "2026-10-07T00:17:09Z",
            "updated": "2026-10-07T00:17:09Z",
            "expires": "2027-10-07T00:17:09Z",
            "status": [
                "ok"
            ],
            "nameservers": [
                "ns1.ultahost.com",
                "ns2.ultahost.com",
                "ns3.ultahost.com",
                "ns4.ultahost.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-22T05:25:25Z",
        "caa_records": {
            "domain": "autoconfig.no-spotify.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-22T05:22:16Z",
            "first": "2026-10-22T05:22:16Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 962
        },
        "security_txt": {
            "present": true,
            "found_in": "/.well-known/security.txt"
        },
        "trackers": {
            "requests": 1
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 389,
                "tls": 137,
                "wait": 169,
                "connect": 130,
                "download": 0
            },
            "response_ms": 825
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                21,
                25,
                80,
                110,
                143,
                443,
                587,
                993,
                995
            ]
        },
        "carbon": {
            "bytes": 874,
            "co2_grams": 0,
            "cleaner_than": 95
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "149.28.254.81",
                    "host": "ns4.ultahost.com"
                },
                {
                    "ip": "167.71.73.238",
                    "host": "ns1.ultahost.com"
                },
                {
                    "ip": "94.130.75.18",
                    "host": "ns3.ultahost.com"
                },
                {
                    "ip": "51.38.114.43",
                    "host": "ns2.ultahost.com"
                }
            ],
            "zone": "no-spotify.com"
        },
        "location": {
            "ip": "198.54.132.28",
            "asn": "11878",
            "org": "tzulo, inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR1",
            "subject": "no-spotify.com"
        },
        "dns": {
            "A": [
                "198.54.132.28"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "198.54.132.28",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://autoconfig.no-spotify.com"
            ]
        },
        "tech_stack": {
            "technologies": [
                "LiteSpeed",
                "HTTP/3"
            ]
        },
        "whois": {
            "registrar": "Ultahost, Inc.",
            "created": "2026-10-07T00:17:09Z",
            "updated": "2026-10-07T00:17:09Z",
            "expires": "2027-10-07T00:17:09Z",
            "status": [
                "ok https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.ultahost.com",
                "ns2.ultahost.com",
                "ns3.ultahost.com",
                "ns4.ultahost.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "LiteSpeed",
                "content-type": "application/xml"
            }
        }
    }
}
```