spinnhart[.]com

PhishDestroy flags spinnhart.com as a generic phishing domain designed to steal cryptocurrency through a fake wallet-drainer kit. No specific cryptocurrency brand is mimicked in the available intelligence, suggesting a general-purpose drainer may be deployed once victims land on the page. The domain resolves to a single IPv4 address (52.222.236.30) on Amazon’s cloud, which is typical for short-lived phishing campaigns seeking high availability at low cost. This domain was registered on 10 August 2025 through NameSilo, LLC in the same month it went live, indicating a very recent campaign. VirusTotal currently shows 0 detections out of 95 engines, meaning the payload remains undetected by most antivirus products. Google Safe Browsing has not yet blacklisted the domain, and public blocklists show zero entries, leaving end-users fully exposed. The Amazon SSL certificate adds a veneer of legitimacy but does not guarantee safety. The threat is ACTIVE and under investigation by PhishDestroy. Immediate user action includes blocking both the domain and the IP (52.222.236.30) at the network or DNS level. Until the domain is sinkholed or blacklisted by major browsers, treat any interaction as high-risk; refrain from connecting wallets or entering seed phrases. Remaining risk is HIGH while the domain remains unlisted on major threat intelligence platforms and continues to resolve.