spinflux[.]live

PhishDestroy identifies spinflux.live as an active crypto drainer domain employing tactics designed to siphon cryptocurrency assets from unsuspecting users. The domain leverages deceptive branding likely targeting the gaming community, with infrastructure engineered to facilitate unauthorized wallet connections and token transfers. While no specific drainer kit signature has been publicly disclosed, the rapid deployment timeline and SSL issuance suggest a freshly stood-up operation optimized for phishing campaigns. This assessment places the threat at the high end of the generic phishing spectrum due to its immediate operational intent and absence of prior detection mitigations.

Technical indicators confirm the domain resolves to IP 104.21.82.247 (Cloudflare range) and was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on 2026-02-25—just days before detection. The SSL certificate was issued by Let's Encrypt, providing a false sense of legitimacy while the domain remains unflagged across VirusTotal with a 2/95 detection score. Google Safe Browsing (GSB) has not blacklisted spinflux.live at analysis time, and no third-party blocklists have flagged the domain despite its clear malicious intent. The creation date's proximity to report generation indicates a likely fresh campaign, minimizing historical reputation data availability.

As of this assessment, spinflux.live remains in an active phishing state with no observable takedown or mitigation measures. Response actions initiated by PhishDestroy include domain classification under crypto drainer threat taxonomy and submission to threat intelligence feeds. However, the remaining risk remains elevated due to the domain's recent activation, lack of detection by security vendors, and potential for rapid campaign evolution. Users are strongly advised to avoid interacting with spinflux.live, verify any similar domains through PhishDestroy, and remain vigilant for gaming-related impersonation phishing attempts.