spiralethereal[.]shop

Analysis indicates spiralethereal.shop is an active phishing domain exhibiting high-risk characteristics. The domain, registered on June 12, 2026, through Namecheap, Inc., currently resolves to 172.67.163.179, a Cloudflare IP address located in Canada. Infrastructure analysis reveals the site is proxied through Cloudflare, utilizing HTTP/3 and presenting a 301 HTTP status, which may be employed to obscure the true origin server. The domain appears on one security blocklist and is flagged by five security vendors in aggregated threat intelligence, though the specific nature of the phishing content remains unconfirmed due to the unreachable origin (523 error). The SSL certificate, issued by Let's Encrypt, does not provide additional risk indicators beyond standard encryption practices. Defenders should note the domain's recent registration, Cloudflare proxy usage, and presence in four AlienVault OTX threat intelligence pulses as concrete indicators of malicious intent. The site remains active as of July 12, 2026, and is currently blocked by at least one security provider. Immediate blocking of the domain and its associated IP is recommended pending further analysis of the phishing kit or targeted brand, which has not yet been identified in available data.