spacewin[.]cc

PhishDestroy identifies spacewin.cc as an active phishing domain engaged in credential harvesting through deceptive login portals. The domain is currently classified under the threat type 'generic_phishing' and remains in active operation as of the latest intelligence update. No specific brand impersonation has been confirmed at this time, but the site employs social engineering tactics to trick users into submitting sensitive information.

This domain was flagged by 3 of 95 VirusTotal security vendors, indicating limited but notable detection coverage. It resolves to IP address 104.21.46.186 and was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on April 26, 2026. The domain is protected by a Let’s Encrypt SSL certificate, which may enhance its perceived legitimacy to unsuspecting users. Despite its recent creation, the low blocklist presence suggests it is either newly operational or carefully managed to evade early detection systems.

Given its elevated risk level and active status, users are strongly advised to avoid interacting with spacewin.cc entirely. Organizations should implement network-level blocking of the domain and associated IP address (104.21.46.186) to prevent accidental exposure. If credential compromise is suspected, users should immediately rotate passwords and enable multi-factor authentication on all relevant accounts. Security teams are encouraged to monitor for any downstream compromise resulting from interactions with this domain and report indicators to threat intelligence platforms. Proactive user education on identifying phishing lures remains the most effective defense against such rapidly deployed threats.