Phishing detection: spotify-payment.click

Spotify
https://spotify-payment.click Access site
Screenshot
Screenshot of spotify-payment.click
Investigate
Domain spotify-payment.click5 CT hosts on apex
urlscan page.domain VirusTotal Whois

See every phishunt record for this domain

IP 34.76.205.124
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://spotify-payment.click
urlscan Wayback archive.today
Cert ZeroSSL GmbH
crt.sh Censys Google CT
Phishunt analysis Beta
29 low suspicionheuristic risk score · not a probability
Why?
  • +5.3 Keyword match
  • +5.1 Site cluster
  • +3.7 Brand in domain label
  • +3.0 PhishTank
  • +2.2 Country mismatch
  • +2.1 ASN reputation
  • +1.3 Suspicious TLD
  • +1.1 No CSP header
  • +1.1 No HSTS header
  • +0.8 Brand + login token
  • +0.8 Young domain
  • +0.7 Brand in cert SAN
  • +0.7 Unrecognised DNS provider
  • +0.5 Young certificate
  • +0.4 Long domain
  • +0.3 Free CA
  • +0.1 Hyphens
  • +0.1 External scripts
21 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting

Site impersonates Spotify using a combosquatted domain on the abusable .click TLD, targeting subscriber payment credentials. Confirmed malicious by PhishTank, hosted on Google Cloud infrastructure in Belgium, and uses email-only clone references consistent with a phishing campaign.

PhishTankBrand + login tokenBrand in domain label
AI-generated from stored detector signals - the AI never visited the site. · 2026-09-18 · confidence 88%
Domain & Network
Whois
Registrar Sav.com, LLC
Network
IP 34.76.205.124
Country BelgiumBelgium
Hosting Google LLC
ASN AS396982
TLS Cert ZeroSSL GmbH
External detection PhishTank
CleanGoogle Safe Browsing · OpenPhish · TweetFeed · urlscan.io
Report this phishing
Network / ASN Google LLC
Web form
Registrar Sav.com, LLC
abuse@sav.com
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-09-17 19:02 UTC  ·  Last refreshed 2026-09-20 09:30 UTC