spinkilla[.]live

On July 25, 2026, spinkilla.live was identified as a malicious domain employed for crypto gambling phishing. The domain is registered through NiceNIC International Group Co., Limited and resolves to the Cloudflare‑hosted address 104.21.26.137, an IP located in the United States and belonging to ASN13335 Cloudflare, Inc. Authoritative nameservers are alexandra.ns.cloudflare.com and kayden.ns.cloudflare.com, confirming the use of Cloudflare's DNS infrastructure. No SSL certificate was observed for the host, indicating that HTTPS was not configured at the time of analysis. Threat‑intelligence aggregators have flagged the domain: VirusTotal reports that 16 of 93 security vendors labeled it as malicious, and PhishDestroy has added it to its blocklist.

The domain also appears on one additional security blocklist, and Gridinsoft assigned an extreme low trust score of 1 out of 100. The site was categorized as a crypto gambling scam, consistent with a pattern of phishing operations that lure victims with promises of cryptocurrency betting. Current status shows the site taken offline, suggesting the operators have withdrawn the content, but the underlying infrastructure (IP address and Cloudflare services) remains reusable. Concrete details such as the exact page title, landing‑page content, or credential‑harvesting mechanisms have not been captured, leaving the specific tactics employed uncertain.

Defenders should block spinkilla.live at DNS and web‑proxy layers, monitor outbound traffic to the associated IP address and Cloudflare nameservers, and add the domain to internal blocklists. Email filters should treat any messages referencing spinkilla.live as malicious, and incident‑response teams should advise users to avoid clicking related links. Ongoing surveillance of new domains registered with the same registrar or similar naming conventions is recommended to detect potential re‑use of the same threat actor’s infrastructure.