spend-debit[.]org

On July 22, 2026, analysts observed the newly registered domain spend-debit.org resolving to the IP address 82.221.141.201. The domain was created on July 21, 2026 and is hosted by Cloudflare, as indicated by the authoritative name servers elias.ns.cloudflare.com and roxy.ns.cloudflare.com. Registration was performed through Key-Systems GmbH, a registrar commonly used for both legitimate and malicious registrations. The domain is currently active and appears on a single security blocklist; it is listed by PhishDestroy, which suggests that at least one security vendor has identified it as part of a phishing operation.

VirusTotal reports that the domain has been scanned by 95 engines, none of which returned a detection at the time of analysis. While the absence of detections does not confirm safety, it also indicates that the payload or landing page may not yet contain known malicious signatures. No additional intelligence such as Safe Browsing verdicts, Open Threat Exchange (OTX) references, SSL certificate details, HTTP response codes, trust‑score metrics, page title, or public evidence links have been published.

Consequently, the confidence in the precise malicious behavior is limited to the blocklist entry and the classification as a generic phishing campaign. Defenders should block or sinkhole spend-debit.org at the DNS level, monitor outbound connections to 82.221.141.201, and include the domain in email gateway rule sets. Continuous re‑evaluation is recommended as further telemetry, such as payload samples or victim reports, become available.