uspin[.]world

Analysis of uspin.world indicates a recent brand‑impersonation campaign targeting the Solana cryptocurrency ecosystem. The domain was registered on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the Cloudflare address 104.21.5.32, located in the United States under ASN 13335. No TLS certificate was observed, meaning the site operated over plain HTTP. The page title returned by the server is “SOLANA SPIN”, matching the declared scam type of a crypto‑related scam. The domain’s nameservers are ns1.verification‑hold.suspended-domain.com and ns2.verification‑hold.suspended‑…, suggesting the registrar placed the domain in a verification‑hold state after detection.

VirusTotal records show that one of ninety‑three scanning engines flagged the domain, and Gridinsoft assigned a trust score of 0 / 100. The domain appears on a single external security blocklist and has been actively blocked by the PhishDestroy service. Current HTTP status is offline, indicating that the site has been taken down or otherwise rendered inaccessible. Evidence confirms the intent to deceive users by leveraging the Solana brand, but no additional payload or credential‑harvesting infrastructure has been publicly disclosed.

The lack of an SSL certificate and the use of a generic “SOLANA SPIN” title are consistent with a superficial impersonation rather than a full‑featured phishing portal. Defenders should continue to block the IP address 104.21.5.32 and add uspin.world to domain‑based blocklists. Monitoring of Cloudflare edge nodes associated with ASN 13335 for similar newly‑registered domains is advised. Since the site is offline, immediate remediation is limited, but threat‑intel feeds should be updated to reflect the observed indicators and the domain’s registration details for future correlation.