# PhishDestroy domain threat record: spotifyzonepro-dl.fwh.is

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/spotifyzonepro-dl.fwh.is/
Machine-readable companion: https://phishdestroy.io/domain/spotifyzonepro-dl.fwh.is/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-06 00:04:35 UTC
- Last availability or vendor check: 2026-10-23 10:43:50 UTC
- Stored record updated: 2026-10-23 18:22:40 UTC
- VirusTotal detections in the stored snapshot: 13/91
- Independent public blocklist matches in the stored snapshot: 1
- Matching public blocklists: Phishunt
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: spotify

## Stored infrastructure

- Observed IP address: 185.27.134.139
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Last stored HTTP status: 200
- Registration date (registry RDAP, fwh.is): 2024-11-01 13:55:01 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/019fa5b0-4a78-73c3-8270-10c1b4f08a36/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/spotifyzonepro-dl.fwh.is
- Certificate Transparency search: https://crt.sh/?q=%25.spotifyzonepro-dl.fwh.is
- Web Archive lookup: https://web.archive.org/web/*/https://spotifyzonepro-dl.fwh.is/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
spotifyzonepro-dl.fwh.is is a phishing page that impersonates Spotify. The name combines "zone", "pro" and "dl", the vocabulary of unofficial premium-unlock and download sites, so it targets listeners hoping to get paid Spotify features for free. PhishDestroy first flagged it on 2026-10-06. When rechecked on 2026-10-19, the site was still online and serving content.

How the scam works
Lures of this kind promise a "Pro" or unlocked version of a popular app and then ask the visitor to sign in with their Spotify account or hand over other details to "activate" it. Anything typed into the page goes straight to the operator, and a captured Spotify login can be resold or used to try the same password on email and other services. The page title is just the hostname rather than any branded text, so the Spotify theme comes from the address itself. Victims stand to lose account access, reused passwords, and any payment details they enter.

Evidence
On 2026-10-06, 13 of 91 VirusTotal engines marked the site as malicious, including BitDefender, Certego, CRDF, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data and Gridinsoft. That is a minority of engines, but the vendors span several separate detection ecosystems. Spamhaus lists the domain in its DBL as phishing (DBL_PHISH), which affects mail filtering and resolver-level blocking. The domain also appears on the PhishDestroy and Phishunt blocklists.

Infrastructure
The page is a subdomain of fwh.is, a shared domain on which anyone can create a hostname, so the operator controls only the spotifyzonepro-dl label and not the parent domain. The domain registration dates to 2024-11-01, almost two years before this page was detected. That age reflects the shared parent and says little about when this particular page went up. It resolves to 185.27.134.139 on Wildcard UK Limited's network in Great Britain. It uses a free ZeroSSL domain-validated certificate, so the browser padlock does not mean the site is affiliated with Spotify.

What to do
If you entered your Spotify credentials here, change your Spotify password immediately and sign out of all devices from your account settings. Change the password anywhere else you used it, and turn on two-factor authentication on your email account first. If you entered card details, contact your bank to block the card and dispute any charges. If you downloaded any file from the site, do not run it, and scan your device. Defenders should block the full hostname, alert on traffic to 185.27.134.139, and watch for other Spotify-themed subdomains of fwh.is.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/019fa5b0-4a78-73c3-8270-10c1b4f08a36/
VirusTotal report: https://www.virustotal.com/gui/domain/spotifyzonepro-dl.fwh.is
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=spotifyzonepro-dl.fwh.is
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:31:02 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/019fa5b0-4a78-73c3-8270-10c1b4f08a36.png
  Captured: 2026-10-06 00:04:35 UTC
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/495131f1-eaf9-43ec-9d59-d8ca4d24ce6e.png
  Captured: 2026-10-06 00:06:25 UTC
  Source report: https://radar.cloudflare.com/scan/495131f1-eaf9-43ec-9d59-d8ca4d24ce6e
  SHA-256: 993e6313e149ac12b2d379e59eb1ff4830f9c0898c15a4e7581da80acc66d1bb
- URLScan · 2026-08-09: https://screenshots.phishdestroy.io/us/019fe52d-e6d7-774a-9d7d-990849fdf494.png
  Captured: 2026-08-09 06:20:41 UTC
  Source report: https://urlscan.io/result/019fe52d-e6d7-774a-9d7d-990849fdf494/
  SHA-256: 10d06bb10ad16999d8b215ac79d57e30e8f003a47f686de3602d92295900bf1a
- URLScan · 2026-08-21: https://screenshots.phishdestroy.io/us/01a0224e-6ca5-705c-a22f-5d78b5002513.png
  Captured: 2026-08-21 03:12:47 UTC
  Source report: https://urlscan.io/result/01a0224e-6ca5-705c-a22f-5d78b5002513/
  SHA-256: 10d06bb10ad16999d8b215ac79d57e30e8f003a47f686de3602d92295900bf1a
- URLScan · 2026-09-03: https://screenshots.phishdestroy.io/us/01a0671f-b034-764b-a20e-2c2bd6622fdd.png
  Captured: 2026-09-03 11:55:42 UTC
  Source report: https://urlscan.io/result/01a0671f-b034-764b-a20e-2c2bd6622fdd/
  SHA-256: 10d06bb10ad16999d8b215ac79d57e30e8f003a47f686de3602d92295900bf1a
- URLScan · 2026-09-15: https://screenshots.phishdestroy.io/us/01a0a313-e124-71f8-a749-2f99d5b3616e.png
  Captured: 2026-09-15 03:19:52 UTC
  Source report: https://urlscan.io/result/01a0a313-e124-71f8-a749-2f99d5b3616e/
  SHA-256: 10d06bb10ad16999d8b215ac79d57e30e8f003a47f686de3602d92295900bf1a
- URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e83b-12ee-7052-8c43-e5c5df80521e.png
  Captured: 2026-09-28 13:36:30 UTC
  Source report: https://urlscan.io/result/01a0e83b-12ee-7052-8c43-e5c5df80521e/
  SHA-256: 10d06bb10ad16999d8b215ac79d57e30e8f003a47f686de3602d92295900bf1a
- URLScan · 2026-10-12: https://screenshots.phishdestroy.io/us/01a12e3a-8a0e-7289-8c24-21c42052cbbe.png
  Captured: 2026-10-12 03:49:21 UTC
  Source report: https://urlscan.io/result/01a12e3a-8a0e-7289-8c24-21c42052cbbe/
  SHA-256: 10d06bb10ad16999d8b215ac79d57e30e8f003a47f686de3602d92295900bf1a

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T19:32:06Z",
        "uuid": "019fa5b0-4a78-73c3-8270-10c1b4f08a36",
        "scanned_at": "2026-07-27T22:27:08Z",
        "final_url": "https://spotifyzonepro-dl.fwh.is/",
        "globals": [
            "assert",
            "getRequiredElement",
            "P",
            "S",
            "getRandomNum",
            "getTimeStamp",
            "Dimensions",
            "Config$2",
            "getGlobalConfig",
            "setGlobalConfig",
            "Config$1",
            "Config",
            "setMaxGapCoefficient",
            "setMaxObstacleLength",
            "Status",
            "A11yStrings",
            "RunnerClasses",
            "RunnerSounds",
            "RunnerEvents",
            "updateCanvasScaling",
            "getA11yString",
            "vibrate",
            "createCanvas",
            "decodeBase64ToArrayBuffer",
            "createAdjustedCollisionBox",
            "drawCollisionBoxes",
            "boxCompare",
            "toggleHelpBox",
            "diagnoseErrors",
            "portalSignin",
            "updateForDnsProbe",
            "getMainFrameErrorCssClass",
            "getMainFrameErrorIconCssClass",
            "getSubFrameErrorIconCssClass",
            "shouldShowSuggestionsSummaryList",
            "getSuggestionsSummaryItemCssClass",
            "reloadButtonClick",
            "downloadButtonClick",
            "detailsButtonClick",
            "setAutoFetchState"
        ],
        "domain_age_days": 23,
        "apex_age_days": 633,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": -28,
                "malicious": false
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T19:40:50Z",
        "uuid": "495131f1-eaf9-43ec-9d59-d8ca4d24ce6e",
        "scanned_at": "2026-10-06T00:06:25Z",
        "final_url": "https://errors.infinityfree.net/errors/403/",
        "status": 403,
        "history": [
            {
                "url": "https://spotifyzonepro-dl.fwh.is/",
                "status": 200
            },
            {
                "url": "https://spotifyzonepro-dl.fwh.is/",
                "status": 302
            },
            {
                "url": "https://errors.infinityfree.net/errors/403/",
                "status": 403
            }
        ],
        "dom_hash": "cefc49386bc44a1ac76321491e71e58e6742831cf9db97a512aaf7d059e5724a",
        "doc_hash": "dae45c056b80e4ab2bc6670a7f2c977c681702c167692095f35abe6c526823ae",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "errors.infinityfree.net",
                "type": "A",
                "value": "172.67.71.120"
            },
            {
                "name": "errors.infinityfree.net",
                "type": "A",
                "value": "104.26.8.174"
            },
            {
                "name": "errors.infinityfree.net",
                "type": "A",
                "value": "104.26.9.174"
            },
            {
                "name": "vpassets.infinityfree.net",
                "type": "A",
                "value": "104.26.8.174"
            },
            {
                "name": "vpassets.infinityfree.net",
                "type": "A",
                "value": "104.26.9.174"
            },
            {
                "name": "vpassets.infinityfree.net",
                "type": "A",
                "value": "172.67.71.120"
            }
        ],
        "dnssec_valid": true,
        "ip": "172.67.71.120",
        "whois": {
            "registrar": "NameSilo, LLC",
            "created": "2015-04-18T10:55:56Z",
            "updated": "2024-12-04T12:04:03Z",
            "expires": "2029-04-18T10:55:56Z",
            "nameservers": [
                "beth.ns.cloudflare.com",
                "paul.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T13:16:46Z",
        "analysis_at": "2026-10-01T11:14:54Z",
        "stats": {
            "timeout": 0,
            "harmless": 45,
            "malicious": 12,
            "suspicious": 2,
            "undetected": 33
        },
        "detections": {
            "CRDF": "malicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Certego": "phishing",
            "Webroot": "malicious",
            "AlphaSOC": "suspicious",
            "Fortinet": "malware",
            "Seclookup": "malicious",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "expires": "2027-11-01T00:00:00Z",
        "first_seen": "2026-06-04T20:54:50Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "sectigo.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "trust-provider.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "pki.goog"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "godaddy.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "globalsign.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "certum.pl"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "harica.gr"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "usertrust.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "comodoca.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "microsoft.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "amazontrust.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "letsencrypt.org"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "ssl.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "buypass.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "digicert.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "amazon.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "entrust.net"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "swisssign.com"
            },
            {
                "ttl": 17471,
                "type": "A",
                "value": "185.27.134.139"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "starfieldtech.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "identrust.com"
            }
        ],
        "dns_at": "2026-10-01T11:20:34Z",
        "jarm": "27d27d27d00027d00042d42d000000831b6af40378e2dd35eeac4e9311926e",
        "cert": {
            "san": [
                "fwh.is",
                "*.fwh.is"
            ],
            "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2",
            "serial": "15d1dc0cf6661d7da963ef9c21318c26",
            "sha256": "b720cfc1370df7ea9d6065b50cc5b0639b6e680a5794a409aa8f7984d7b454b3",
            "subject": "fwh.is",
            "valid_to": "2026-12-25T23:59:59Z",
            "valid_from": "2026-09-26T00:00:00Z"
        },
        "whois": {
            "dnssec": "unsigned delegation"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "last changed": "2025-10-03T11:11:59Z",
                "registration": "2024-11-01T13:55:01Z",
                "soft expiration": "2026-11-01T13:47:43Z"
            }
        }
    }
}
```