icespin[.]net

The domain icespin.net was registered on 21 February 2026 through NiceNIC International Group Co., Limited. DNS resolution points to the IP address 104.21.71.165, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presented a page title reading “Icespin: Elon Musk’s Official Crypto Casino Powered by Blockchain,” indicating a targeted lure toward cryptocurrency enthusiasts and possibly leveraging the Elon Musk brand for credibility. No TLS certificate was observed, meaning the site operated without HTTPS encryption.

Analysis flags the domain as employing the publicly available “Gambler Scam” phishing kit, a template commonly used to harvest credentials and monetize victims through fraudulent gambling services. The Gridinsoft trust score of 1/100 further underscores the malicious nature of the infrastructure. Threat intelligence sources show the domain appears on a single security blocklist and is listed in one AlienVault OTX pulse. VirusTotal scans recorded 16 detections out of 95 participating security vendors, confirming active malicious classification.

The domain is currently reported as offline, and PhishDestroy has blocked it, suggesting that mitigation actions have already been taken. Uncertainty remains regarding the exact payload delivered to victims because the page content has not been captured, and the offline status prevents live verification. Defenders should continue to block the IP 104.21.71.165 and the domain icespin.net at perimeter and DNS filtering layers, monitor for any re‑registration attempts, and incorporate the observed indicators—page title, kit name, trust score, and detection counts—into threat‑intel feeds. Ongoing observation of Cloudflare‑hosted infrastructure tied to similar gambling‑oriented phishing campaigns is recommended to pre‑empt future abuse.