premium-subscribe[.]ra-bit[.]eu

Analysis of premium-subscribe.ra-bit.eu shows the domain was taken offline prior to the report date of July 23, 2026. The site resolved to the IPv4 address 45.88.108.231, which is assigned to AS44486 (synlinq.de) and geolocated to Germany. The domain is registered through InterNetX GmbH and uses the authoritative nameservers docks13.rzone.de and shades12.rzone.de. No TLS certificate was observed, indicating the site operated without HTTPS protection.

The page title returned by the HTTP response was "Spotify," suggesting an attempt to impersonate the Spotify brand, although the actual page content was not captured and remains unknown. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single security blocklist. PhishDestroy has explicitly blocked the host, and VirusTotal recorded 16 detections out of 95 scanned security vendors, confirming a consensus that the domain hosted malicious content.

The combination of a zero‑trust score, multiple vendor detections, and blocklist presence indicates a high likelihood of phishing activity targeting Spotify users. Defenders should add premium-subscribe.ra-bit.eu to URL filtering policies, enforce TLS inspection for any residual traffic, and consider blocking the associated IP address 45.88.108.231. Continuous monitoring of the hosting infrastructure and the registrar’s future registrations is advised to detect potential re‑use of the same infrastructure for new campaigns.