phishunt.io flags open.spotify.mint.89237892.com Spotify phishing
phishunt.io flagged open.spotify.mint.89237892.com, registered 31 October 2026, as a Spotify phishing site. The hostname is not operated by Spotify.
- First reported
- Reports
- 1
Source: x.com · published
What happened
On 7 November 2026 the phishing tracker phishunt.io posted on X that open[.]spotify[.]mint[.]89237892[.]com was hosting a Spotify phishing site. It reported that the host was registered on 31 October 2026, seven days earlier, that it resolves to 104.21.67.205 on Cloudflare's network (AS13335) in the United States, and tagged the finding YE2, with a link to its Spotify listing. The domain also appears on the Phishing Army blocklist. The hostname is not operated by Spotify, and Spotify is not involved.
How the scam works
The screenshot attached to the post shows a dark page with a Spotify-style logo, the heading Welcome back, a single email field and a green Continue button, closely copying the real Spotify sign-in screen. The address uses a familiar trick: it begins with open.spotify, like Spotify's real web player, but the actual domain is 89237892.com, which has nothing to do with Spotify. A two-step form that asks for the email first and the password on the next screen makes the page feel like the real login flow.
Spotify phishing is usually spread by emails or texts claiming a payment failed, a subscription is about to be suspended or a family plan needs confirming. Stolen accounts can be resold, used to change the plan, or tried against other services where the same password is reused, and some pages go on to ask for card details to fix the supposed billing problem. Because this domain was only a week old, many filters may not yet block it.
Anyone who entered details should change their Spotify password through the official app or spotify.com, sign out everywhere from the account page, change the same password on any other service, and contact their bank if card details were entered. The indicators come from the tracker's post and have not been independently checked by scammers.com.
Source
Post by phishunt.io on X, 7 November 2026, flagging open.spotify.mint.89237892.com. Not independently verified by scammers.com.
Red flags
- A Spotify login page whose real domain is not spotify.com.
- An address that starts with open.spotify but ends with an unrelated domain.
- An email or text about a failed payment or suspended subscription.
- A request for card details to fix a billing problem.
If you were targeted
- 1Do not enter passwords, card numbers or one-time codes on a page reached from a text, email or ad.
- 2Open the company's official app or type its address yourself to check your account.
- 3If you entered details, change your password at once and contact the company through its official channels.
- 4Report the message and the link to the company and to your national phishing reporting service.
- 5Delete the message without replying or tapping any links.