# www.spnhtop1.com — SUSPICIOUS

> spnhtop1.com is a tech support scam domain registered via NameSilo on Aug 10, 2025, hosting malicious pop-ups mimicking Microsoft. Avoid clicking links.

## Summary
PhishDestroy identifies spnhtop1.com as a tech support scam domain currently under investigation for active phishing operations. This domain poses as a legitimate tech support service, likely impersonating Microsoft or similar brands to deceive users into divulging sensitive information or downloading malicious software. The site remains accessible and operational as of the latest assessment.  

spnhtop1.com was registered through NameSilo, LLC, on August 10, 2025, and resolves to IP address 52.222.236.27. Despite being hosted on an Amazon-issued SSL certificate, the domain has not yet been flagged by any of the 95 VirusTotal security vendors, indicating a low detection rate at this time. Its recent creation and lack of presence on established blocklists suggest it is a newly deployed threat with minimal historical reputation data, increasing its potential risk to unwary users. The absence of detections also highlights the challenges in early-stage phishing detection, as threat actors continuously refine their tactics to evade security measures.  

As this domain remains active and undetected by major security vendors, users should exercise extreme caution when encountering prompts or pop-ups from spnhtop1.com or similar domains. Avoid clicking on any suspicious links or downloading files from the site. If you have already interacted with this domain, scan your device for malware and reset passwords for critical accounts. System administrators are advised to block the domain at the network level and monitor for unusual outbound connections to IP 52.222.236.27. Given the evolving nature of this threat, staying updated with real-time threat intelligence feeds is essential to mitigate risks effectively.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2025-08-10 08:48:17
- Registrar: NameSilo, LLC
- IP: 52.222.236.27

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/3aa4c411-a412-4300-8fab-968a6ece442f
- PhishDestroy: https://phishdestroy.io/domain/www.spnhtop1.com/
- LLM endpoint: https://phishdestroy.io/domain/www.spnhtop1.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/www.spnhtop1.com/
Last updated: 2026-03-27