norskspin[.]site

This domain, norskspin.site, is actively flagged as a high-risk phishing endpoint targeting users of Norsk Tipping, as indicated by the page title 'NorskSpin' and confirmed by multiple threat intelligence sources. Analysis reveals the domain was registered on May 16, 2026, through GoDaddy.com, LLC, and currently resolves to IP address 104.21.30.183. It appears on four security blocklists and is referenced in 16 threat intelligence pulses on AlienVault OTX. Detection engines on VirusTotal flag the domain as malicious, with 13 of 95 security vendors identifying it as a threat. The site employs Cloudflare for hosting and protection, utilizing technologies such as jQuery, Cloudflare Browser Insights, and HTTP/3, alongside a Let's Encrypt SSL certificate. Defenders should note that the domain remains active and is explicitly blocked by multiple security mechanisms, including SEAL, MetaMask, PhishDestroy, and BLP-Malware. The exact phishing methodology or payload delivery mechanism is not yet analyzed, but the infrastructure and detection patterns strongly suggest credential harvesting or fraudulent transaction initiation. Given the domain's recent registration and consistent flagging across multiple sources, it is recommended to treat all interactions with norskspin.site as malicious. Immediate blocking at the DNS, proxy, and endpoint levels is advised, along with monitoring for any internal connections to the IP 104.21.30.183 or related subdomains.