spotify-premium-pay[.]stripe-app-active[.]com

This domain, spotify-premium-pay.stripe-app-active.com, is flagged as a high-risk phishing site targeting users with fake Spotify billing pages. Analysis indicates the domain was registered on July 16, 2026, through Mesh Digital Limited, with nameservers asa.ns.cloudflare.com and major.ns.cloudflare.com, suggesting Cloudflare infrastructure. It currently resolves to IP address 188.114.96.3, which is associated with Cloudflare's network. The domain appears on at least one security blocklist (PhishDestroy), and seven out of 95 security vendors on VirusTotal have detected it as malicious. The domain remains active as of July 20, 2026, with no evidence of takedown or suspension. Infrastructure analysis reveals the use of Cloudflare for DNS and likely proxy services, a common tactic to obscure the true hosting origin and evade detection. The domain name itself mimics a legitimate payment flow, combining 'Spotify,' 'premium,' and 'pay' with a subdomain structure that falsely implies affiliation with Stripe's payment platform. While the exact page content has not been analyzed, the naming convention strongly suggests an attempt to deceive users into entering payment or account credentials under the guise of a Spotify subscription upgrade or renewal. Defenders should treat this domain as an active threat. Blocking the domain at DNS and network levels is recommended, along with monitoring for connections to the IP 188.114.96.3. Given the recent registration and Cloudflare hosting, additional related domains may emerge, warranting proactive threat hunting for similar naming patterns or infrastructure reuse. No evidence links this domain to a known phishing kit or specific threat actor, but the combination of brand impersonation and payment-themed deception aligns with common credential harvesting tactics.