Phishing detection: spotify-accounts-login.callora.cz

Spotify
https://spotify-accounts-login.callora.cz/z/pages/login.php Access site
Screenshot
Screenshot of spotify-accounts-login.callora.cz
Investigate
Domain spotify-accounts-login.callora.cz2 CT hosts on apex
urlscan page.domain VirusTotal Whois
IP 91.218.65.223
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://spotify-accounts-login.callora.cz/z/pages/login.php
urlscan Wayback archive.today
Cert -
crt.sh Censys Google CT
Phishunt analysis Beta
30 low suspicionheuristic risk score · not a probability
Keyword matchBrand in subdomainBrand + login token
21 signals fired · detector v2.0.0
AI analysis AIBeta
Credential harvesting

Impersonates Spotify account login on a Czech-TLD combosquatted domain, serving a PHP login page via an executable path; flagged by OpenPhish and urlscan, with server-side scripting confirming active phishing kit deployment.

Executable pageBrand + login tokenCredential path
AI-generated from stored detector signals - the AI never visited the site. · 2026-07-22 · confidence 79%
Domain & Network
Whois
Network
IP 91.218.65.223
Country GermanyGermany
Hosting synlinq.de
ASN AS44486
TLS Cert -
External detection OpenPhish urlscan.io
CleanGoogle Safe Browsing · PhishTank · TweetFeed
Report this phishing
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-07-20 01:01 UTC  ·  Last refreshed 2026-08-11 07:30 UTC