spiner[.]bet

Analysis of the domain spiner.bet indicates it was actively involved in a crypto-based gambling scam, classified as a generic phishing threat with elevated risk. The domain resolved to IP address 69.5.189.58, hosted on AS42624 (Global-Data System IT Corporation) in Switzerland. No SSL certificate was present, increasing the likelihood of unencrypted credential harvesting. The page title, 'SPINER | Play at the best online casino based on Blockchain,' explicitly identifies the site as a blockchain gambling platform, aligning with the reported scam type of a crypto scam. Infrastructure analysis reveals the domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com and used nameservers ns1.nameserverhub.com, ns2.nameserverhub.com, ns3.nameserverhub.com, and ns4.nameserverhub.com, a configuration commonly observed in phishing operations.

Detection data from security vendors shows limited but notable coverage: four of 95 vendors on VirusTotal flagged the domain as malicious. Additionally, the domain appears on one security blocklist, and Gridinsoft assigned a trust score of 1/100, further indicating its association with fraudulent activity. The domain was identified as using the 'Gambler Scam' phishing kit, a known toolset for deploying fake gambling sites designed to steal user funds or credentials. As of the report date, spiner.bet has been taken offline, though historical DNS and hosting data remain relevant for tracking related infrastructure.

Defenders should treat this domain as part of a broader crypto-gambling phishing campaign. The absence of SSL, use of a low-reputation registrar, and hosting on a bulletproof ASN are consistent with high-risk phishing infrastructure. While the domain is no longer active, monitoring for re-registration or reuse of associated IPs, nameservers, or phishing kits is recommended.