spotifysm[.]netlify[.]app

This domain spotifysm.netlify.app has been identified in connection with brand impersonation activities directed at spotify. The threat carries a high risk classification and maintains an active status according to the latest assessment. Infrastructure analysis reveals that the domain resolves to the IPv6 address 2a05:d014:58f:6200::258 in DE associated with AS16509. Registration occurred via Name.com, Inc on February 21, 2026. Detected technologies encompass Netlify along with HSTS enforcement and the SSL certificate originates from DigiCert Inc specifically the DigiCert Global G2 TLS RSA SHA256 2020 CA1. The site responds with an HTTP status code of 200 and presents a page title matching Spotify while the scam classification is streaming. Further indicators include a Gridinsoft trust score of 0/100 and a Scamadviser trust score of 0/100. The domain is listed on 1 security blocklist and has been blocked by PhishDestroy. On VirusTotal 20 out of 95 security vendors have flagged the domain. These metrics collectively support the high risk designation for the impersonation effort. Details that are not fully established include the exact operational mechanics of the streaming scam beyond the metadata provided. Without comprehensive content review the full extent of the impersonation tactics stays undetermined at this stage. The use of Netlify hosting suggests potential for quick changes but additional monitoring would clarify persistence patterns. Defenders reviewing this domain are advised to incorporate the IP address 2a05:d014:58f:6200::258 and the domain itself into block policies given the vendor flags and blocklist presence. Ongoing surveillance of similar registrations through Name.com, Inc with comparable creation dates and streaming associations can help identify related threats early. Coordination with blocklist providers may enhance coverage for active instances like this one.