# PhishDestroy domain threat record: spotify-premium.in

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/spotify-premium.in/
Machine-readable companion: https://phishdestroy.io/domain/spotify-premium.in/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-25 03:19:42 UTC
- Last availability or vendor check: 2026-10-25 11:28:44 UTC
- Stored record updated: 2026-10-25 15:23:57 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: spotify

## Stored infrastructure

- Observed IP address: 172.67.168.155
- Registrar in stored WHOIS data: Dynadot, LLC
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-09-28 06:36:58 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17111-85e0-779c-8e9d-b037f06529d5/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/spotify-premium.in
- Certificate Transparency search: https://crt.sh/?q=%25.spotify-premium.in
- Web Archive lookup: https://web.archive.org/web/*/https://spotify-premium.in/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake AI classified the domain as malicious because it impersonates Spotify and advertises a “Spotify Premium APK v9.0.84” for Android. The page was first seen by PhishDestroy on 2026-10-25, and an HTTP 200 response was recorded on that date.

How the scam works
Fake‑APK pages use well‑known brands to lure users into downloading modified Android packages. The offered APK typically contains malware, adware, or code that can steal credentials, track activity, or charge the device without the user’s consent.

Evidence
PhishDestroy’s internal blocklist listed the domain on 2026-10-25. URLScan captured the site on 2026-10-25, scored it 100/100 as malicious, and tagged it as phishing with the Spotify brand. VirusTotal scanned the domain on 2026-10-25 with 92 engines and reported zero malicious and zero suspicious detections. Google Safe Browsing checked the domain on 2026-10-25 and did not flag it. OTX recorded three pulses mentioning the domain on 2026-10-25. No external blocklists reported the domain on the same date.

Infrastructure
The domain was registered on 2026-09-28 with Dynadot, LLC. The recorded DNS records listed two A addresses (104.21.26.239 and 172.67.168.155) and two AAAA addresses, and the domain used Cloudflare nameservers colette.ns.cloudflare.com and colin.ns.cloudflare.com. The TLS certificate, issued by Let’s Encrypt, covered *.spotify-premium.in and was valid from 2026-09-30 to 2026-12-29.

What to do
Do not download or install any APK from this site and run a malware scan on any device where it may have been installed. Defenders should block the exact domain and monitor network logs for connections to the recorded Cloudflare IP addresses.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17111-85e0-779c-8e9d-b037f06529d5/
Cloudflare Radar report: https://radar.cloudflare.com/scan/822755de-7f00-47ff-9c0c-4ce248944726
Stored capture screenshot: https://i.ibb.co/Kp9NBpQ8/ac0ed12c250c.png
Cloudflare Radar screenshot (2026-10-25T04:03:18Z): https://screenshots.phishdestroy.io/cf/822755de-7f00-47ff-9c0c-4ce248944726.png
URLScan screenshot (2026-09-30T07:44:30Z): https://screenshots.phishdestroy.io/us/01a0f145-9117-7186-8b5e-a34ffeea5697.png
URLScan capture report: https://urlscan.io/result/01a0f145-9117-7186-8b5e-a34ffeea5697/
URLScan screenshot (2026-09-30T09:32:59Z): https://screenshots.phishdestroy.io/us/01a0f1a8-e2d2-7736-8c92-11185cc8cb8c.png
URLScan capture report: https://urlscan.io/result/01a0f1a8-e2d2-7736-8c92-11185cc8cb8c/
VirusTotal report: https://www.virustotal.com/gui/domain/spotify-premium.in
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=spotify-premium.in
Archived copy: https://web.archive.org/web/20261025031858/https://spotify-premium.in/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-25 04:05:56 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/Kp9NBpQ8/ac0ed12c250c.png
  Captured: 2026-10-25 03:19:42 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a17111-85e0-779c-8e9d-b037f06529d5.png
  Captured: 2026-10-25 03:19:42 UTC
  Source report: https://urlscan.io/result/01a17111-85e0-779c-8e9d-b037f06529d5/
- URLScan capture 2: https://urlscan.io/screenshots/01a0f1a8-e2d2-7736-8c92-11185cc8cb8c.png
  Captured: 2026-10-25 03:18:45 UTC
  Source report: https://urlscan.io/result/01a17111-85e0-779c-8e9d-b037f06529d5/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/822755de-7f00-47ff-9c0c-4ce248944726.png
  Captured: 2026-10-25 04:03:18 UTC
  Source report: https://radar.cloudflare.com/scan/822755de-7f00-47ff-9c0c-4ce248944726
  SHA-256: 7fb3f34db8cd78193591ec68c2e95c941dc9a49748496cad38393288a0f0e45a
- URLScan · 2026-09-30: https://screenshots.phishdestroy.io/us/01a0f145-9117-7186-8b5e-a34ffeea5697.png
  Captured: 2026-09-30 07:44:30 UTC
  Source report: https://urlscan.io/result/01a0f145-9117-7186-8b5e-a34ffeea5697/
  SHA-256: 321e62db35c72b6d6816df04c1381cdb2c331438bd84d13c06da6b961098e064
- URLScan · 2026-09-30: https://screenshots.phishdestroy.io/us/01a0f1a8-e2d2-7736-8c92-11185cc8cb8c.png
  Captured: 2026-09-30 09:32:59 UTC
  Source report: https://urlscan.io/result/01a0f1a8-e2d2-7736-8c92-11185cc8cb8c/
  SHA-256: 3788e1ed31387e5541bb4a4f41784d180782ed1a21af0d017bc1b23506a63689

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-25T03:28:23Z",
        "uuid": "01a17111-85e0-779c-8e9d-b037f06529d5",
        "scanned_at": "2026-10-25T03:19:01Z",
        "final_url": "https://spotify-premium.in/",
        "status": 200,
        "ip": "104.21.26.239",
        "ips": [
            "104.21.26.239"
        ],
        "asns": [
            "13335"
        ],
        "link_domains": [
            "www.facebook.com",
            "twitter.com",
            "api.whatsapp.com",
            "t.me",
            "www.linkedin.com"
        ],
        "social": [
            "https://www.facebook.com/sharer/sharer.php",
            "https://twitter.com/intent/tweet",
            "https://api.whatsapp.com/send",
            "https://t.me/share/url"
        ],
        "doc_hash": "a0c1d0ea8e751e21c12c30a173e41156a467087345df35827c213bf919aefe17",
        "script_hashes": [
            "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8",
            "ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142"
        ],
        "globals": [
            "__cfQR",
            "__cfRLUnblockHandlers"
        ],
        "tls": {
            "san": [
                "*.spotify-premium.in",
                "spotify-premium.in"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "spotify-premium.in",
            "protocol": "QUIC",
            "valid_to": "2026-12-29T06:20:54Z",
            "valid_from": "2026-09-30T06:20:55Z"
        },
        "domain_age_days": 24,
        "apex_age_days": 24,
        "tls_age_days": 24,
        "tls_valid_days": 89,
        "requests": 7,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 92,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "spotify"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Spotify"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-25T04:05:27Z",
        "uuid": "822755de-7f00-47ff-9c0c-4ce248944726",
        "scanned_at": "2026-10-25T04:03:18Z",
        "final_url": "https://spotify-premium.in/",
        "status": 200,
        "history": [
            {
                "url": "https://spotify-premium.in/",
                "status": 200
            }
        ],
        "dom_hash": "faca2ce0f9d89142c6901c7e7850fdb540dab88b9f25b59c4da9c0e3eed42858",
        "doc_hash": "e21cb333f2b9bb40f01eb50ec8ce2bf74f78e9997c6f573aaed4fa9ebbd6abfe",
        "phishing_v2": [
            "phishing"
        ],
        "url_risks": [
            "Phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "spotify-premium.in",
                "type": "A",
                "value": "104.21.26.239"
            },
            {
                "name": "spotify-premium.in",
                "type": "A",
                "value": "172.67.168.155"
            },
            {
                "name": "spotify-premium.in",
                "type": "AAAA",
                "value": "2606:4700:3035::ac43:a89b"
            },
            {
                "name": "spotify-premium.in",
                "type": "AAAA",
                "value": "2606:4700:3036::6815:1aef"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.26.239",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "Dynadot, LLC",
            "created": "2026-09-28T08:36:58Z",
            "updated": "2026-10-03T08:37:20Z",
            "expires": "2027-09-28T08:36:58Z",
            "nameservers": [
                "colette.ns.cloudflare.com",
                "colin.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-25T04:01:50Z",
        "analysis_at": "2026-10-25T03:53:03Z",
        "stats": {
            "timeout": 0,
            "harmless": 0,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 92
        },
        "reputation": 0,
        "registrar": "Dynadot, LLC",
        "created": "2026-09-28T08:36:58Z",
        "expires": "2027-09-28T08:36:58Z",
        "updated": "2026-09-30T07:14:00Z",
        "first_seen": "2026-09-30T09:04:25Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.26.239"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3036::6815:1aef"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "colin.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "colette.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.168.155"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "colette.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::ac43:a89b"
            }
        ],
        "dns_at": "2026-10-25T03:58:20Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.spotify-premium.in",
                "spotify-premium.in"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "6c6fa881215942d966badef90fdf8023a9d",
            "sha256": "2685e637d63bc24ab9230fb862d286aff9180b77f96e85b2d94e1673fd2c95e4",
            "subject": "spotify-premium.in",
            "valid_to": "2026-12-29T06:20:54Z",
            "valid_from": "2026-09-30T06:20:55Z"
        },
        "whois": {
            "registrar": "Dynadot, LLC",
            "registrar_iana_id": "472",
            "registrar_url": "www.dynadot.com",
            "created": "2026-09-28T08:36:58Z",
            "updated": "2026-09-30T07:14:00Z",
            "expires": "2027-09-28T08:36:58Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "colette.ns.cloudflare.com",
                "colin.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-09-28T08:36:58Z",
                "last changed": "2026-09-30T07:14:01Z",
                "registration": "2026-09-28T08:36:58Z",
                "registrar expiration": "2027-09-28T08:36:58Z",
                "last update of RDAP database": "2026-10-23T11:17:31Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-25T03:49:43Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "spotify-premium.in"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-25T03:18:58Z",
            "first": "2026-09-30T10:54:39Z",
            "changes": 1,
            "days_archived": 2,
            "scans_per_day": 0.04,
            "avg_page_bytes": 12869
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true
        },
        "sitemap": {
            "present": true,
            "url_count": 20
        },
        "social_tags": {
            "ogUrl": "https://spotify-premium.in/",
            "title": "Spotify Premium APK v9.0.84 Download for Android (2026)",
            "author": "spotify-premium.in",
            "ogType": "article",
            "robots": "index, follow",
            "ogImage": "https://spotify-premium.in/uploads/spotify-banner.png",
            "ogTitle": "Spotify Premium APK v9.0.84 Download for Android (2026)",
            "keywords": "spotify premium apk, spotify premium mod apk, spotify premium download, spotify premium apk latest version, spotify premium free, spotify mod apk android",
            "ogSiteName": "spotify-premium.in",
            "themeColor": "linear-gradient(   180deg,   #3f4442 0%,   #2f3331 35%,   #181919 70%,   #111111 100% );",
            "description": "Download Spotify Premium APK latest version for Android. Listen without ads, skip unlimited tracks, play any song on demand and save music for offline use.",
            "twitterCard": "summary_large_image",
            "canonicalUrl": "https://spotify-premium.in/",
            "ogDescription": "Download Spotify Premium APK latest version for Android. Listen without ads, skip unlimited tracks, play any song on demand and save music for offline use."
        },
        "trackers": {
            "requests": 6
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 13,
                "tls": 16,
                "wait": 124,
                "connect": 8,
                "download": 6
            },
            "response_ms": 167
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 85058,
            "co2_grams": 0.0031,
            "cleaner_than": 25
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.195.75",
                    "host": "colin.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.34.28",
                    "host": "colette.ns.cloudflare.com"
                }
            ],
            "zone": "spotify-premium.in"
        },
        "location": {
            "ip": "2606:4700:3036::6815:1aef",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "spotify-premium.in"
        },
        "dns": {
            "A": [
                "172.67.168.155",
                "104.21.26.239"
            ],
            "NS": [
                "colette.ns.cloudflare.com",
                "colin.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"colette.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416305526, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3035::ac43:a89b",
                "2606:4700:3036::6815:1aef"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3035::ac43:a89b",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://spotify-premium.in"
            ]
        },
        "linked_pages": {
            "external": [
                "https://www.facebook.com/sharer/sharer.php",
                "https://twitter.com/intent/tweet",
                "https://api.whatsapp.com/send",
                "https://t.me/share/url",
                "https://www.linkedin.com/sharing/share-offsite/"
            ],
            "external_count": 5,
            "internal_count": 13
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=UTF-8"
            }
        }
    }
}
```