hitnspin[.]gl

hitnspin.gl has been confirmed as an active crypto drainer impersonating legitimate crypto brands. This fraudulent domain was registered on February 19, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to IP 104.21.5.2. The site deploys a crypto drainer kit designed to steal digital assets during fraudulent transactions, targeting unsuspecting users engaging with spoofed deposit or burn pages. The technical indicators are explicit and concerning: VirusTotal currently shows 9/95 detections, indicating zero detection by mainstream antivirus engines as of last evaluation. The domain is protected by a Let's Encrypt SSL certificate, which increases user trust while masking malicious intent. The creation date is alarmingly recent—February 19, 2026—suggesting a hastily launched campaign. Registrar details point to a privacy-friendly provider that may hinder rapid takedown. There is no public blocklist entry yet, highlighting the need for proactive reporting. As of the latest update, hitnspin.gl remains active and under investigation with a status classified as active. PhishDestroy identifies this domain as a high-risk crypto drainer scam with ongoing threat potential. Immediate action is required: users should avoid accessing this domain entirely, block the IP 104.21.5.2, and report the domain to hosting providers and cybersecurity platforms. Time to detection and response is critical—delays may result in further asset losses. Organizations and individuals are urged to monitor wallet addresses and monitor for unauthorized transactions associated with any interaction with this domain.