spotify-accounts-login[.]callora[.]cz

Analysis indicates that spotify-accounts-login.callora.cz is an active credential phishing domain targeting Spotify users. The domain was registered on January 20, 2026, through REG-WEBSUPPORT and remains operational as of July 21, 2026. Infrastructure analysis reveals it resolves to IP address 91.218.65.223 and uses nameservers ns1.websupport.sk, ns2.websupport.sk, and ns3.websupport.sk, suggesting hosting via WebSupport infrastructure. The domain is blocked by at least three security blocklists, including PhishDestroy, OpenPhish, and Phishunt, and is flagged by 12 of 95 security vendors on VirusTotal, confirming its malicious classification. The subdomain structure ('spotify-accounts-login') explicitly signals intent to harvest Spotify login credentials, though the exact content of the phishing page has not been analyzed. No evidence of a phishing kit or additional brand impersonation is present in the available data. Defenders should treat this domain as high-risk and prioritize blocking it at DNS, proxy, and endpoint layers. Network logs should be reviewed for connections to 91.218.65.223 or the domain itself, particularly from endpoints associated with user authentication workflows. If internal phishing simulations or awareness programs reference Spotify-themed threats, this domain may serve as a relevant example for training purposes. Further investigation into the hosting provider's abuse response and potential takedown efforts is recommended.