DomainTools internal monitoring identified a cluster of domains targeting Spotify job-seekers, with 389 domains and counting from Monday 2025-05-12 onward. The new domains diverge markedly from the main/known-good spotify[.]com domain, and are registered through Dynadot or Cosmotown and protected by Cloudflare. Many of these domains already show Google or Googlemail MX records.
Though their ultimate purpose remains unclear, the surge in domains targeting tech job-seekers aligns closely with the sharp rise in job-application scams over the past year.
The node visualization shown below shows an incredibly tight clustering of the observed domains across seven metrics, indicating a coordinated campaign.
A full CSV file of the domains can be found on Github.
Domain profile:
First seen: 2025-05-12 or later
Registrar: Dynadot or Cosmotown
Nameservers: Cloudflare
IPspace: Cloudflare
DomainTools Iris users can import the investigation with this hash:
U2FsdGVkX189XliTt+KJJHzYAfeaSNhbE3ZX6qsfyKQERoUcqps0CFBo1GHjm7Mz1kFO6amYR4WJXelBYOXiVAqhnaJUK+475yK8OlwGuw9CU0nimtykulVSRLcZ/CRieiDXkRUnyLRN5tcRHO+s1/4KCLYPX8Y5v7x1J2bpWxXQYjeAp/2wS/d/UAi6oTdYYQvb8fBW2s0545wE8hAEuqGXuSEgXTx9derkh2POxKx0KZZQy9c2FkCEoGLn47UjLFJu78/Z0GNsWXnOch15eF6VFTz5NSB8/dnnudhtPLFrW0kz2byE8doEJE7Ziq9L
