Analysis of spinepandas.com indicates a recently registered domain exhibiting characteristics consistent with phishing infrastructure. The domain was created on July 27, 2026, and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 188.114.97.3 and utilizes Cloudflare nameservers (stan.ns.cloudflare.com and violet.ns.cloudflare.com), a common tactic to obscure hosting origins and evade detection. As of July 31, 2026, the domain appears on one security blocklist, specifically PhishDestroy, which has flagged it for potential malicious activity.
No detections were reported by the 91 vendors that scanned the domain on VirusTotal, though this absence does not confirm safety and should not be interpreted as an all-clear. The domain remains active, and its content has not been fully analyzed, so the specific phishing target or lure (e.g., login credential theft, financial fraud) is not yet confirmed. Defenders should treat this domain as suspicious based on its recent registration, Cloudflare-backed infrastructure, and blocklist inclusion.
Network-level blocking or monitoring of connections to 188.114.97.3 and spinepandas.com is recommended pending further analysis. Additional scrutiny of domains registered through the same registrar or resolving to this IP may reveal related malicious activity. No brand association or phishing kit has been identified in the available data, and the exact threat actor or campaign remains unknown.