Phishing detection: autoconfig.no-spotify.com
Spotify Screenshot
Investigate
Domain
autoconfig.no-spotify.com10 CT hosts on apex
urlscan
VirusTotal
Whois
IP
198.54.132.28
ipinfo
Greynoise
URL
https://autoconfig.no-spotify.com
Phishunt analysis Beta
44
high suspicion likely_phishingheuristic risk score · not a probability
Why?
- +6.1 Google Safe Browsing
- +5.3 Keyword match
- +4.1 Brand in screenshot
- +4.1 Site cluster
- +3.5 ASN reputation
- +3.4 Cert reuse
- +3.4 Shared IP cluster
- +3.2 Young domain
- +2.2 Country mismatch
- +1.3 Brand typo
- +1.1 No CSP header
- +1.1 No HSTS header
- +0.9 No registrar lock
- +0.7 Brand in cert SAN
- +0.7 Unrecognised DNS provider
- +0.6 Login text in screenshot
- +0.6 Registrar reputation
- +0.5 Young certificate
- +0.5 Long domain
- +0.3 Free CA
- +0.2 Suspicious TLD
- +0.1 Hyphens
- +0.1 Deep subdomain
26 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting
Spotify-themed phishing on an autoconfig subdomain of a lookalike domain, reusing resources from a known clone. Its certificate names the brand, and Google Safe Browsing flags it. Hosted in Canada on an IP shared with sibling subdomains.
Brand in cert SANGoogle Safe BrowsingShared page assets
AI-generated from stored detector signals - the AI never visited the site. · 2026-10-14 · confidence 75%
Domain & Network
Whois
Registrar
Ultahost, Inc.
Network
Country
Canada
Canada
Hosting
tzulo, inc.
ASN
AS11878
TLS Cert
YR1
External detection
Google Safe Browsing
GSB category: SOCIAL_ENGINEERING
CleanOpenPhish · PhishTank · TweetFeed · urlscan.io
Requests
Resources
Observables
Related websites
Report this phishing
Submit to blocklists