candyspinz[.]pro

The domain candyspinz.pro is identified as a credential theft scam specifically targeting users of the CandySpins Casino brand. Analysis indicates the site is designed to harvest login credentials by mimicking the legitimate casino’s portal for Portuguese-speaking users. As of the latest assessment, the domain has been taken offline, though prior activity suggests it was actively used for malicious purposes. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.15.10 and employs technologies such as Hugo for static site generation and Cloudflare for content delivery and protection, including HTTP/3 support. The domain is flagged by 2 of 95 security vendors on VirusTotal and appears on two security blocklists, including PhishDestroy and OISD. Additional risk indicators include a Gridinsoft trust score of 0/100 and an SSL certificate issued by Google Trust Services, which, while valid, does not mitigate the underlying malicious intent. Current status confirms the domain is offline, reducing immediate exposure. However, users who may have interacted with the site should assume their credentials were compromised and take immediate action. Recommended steps include resetting passwords for any accounts accessed via the domain, enabling multi-factor authentication where available, and monitoring financial or gaming accounts for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP address to prevent future access attempts. Given the domain’s recent creation date and use of evasion techniques, continued vigilance is advised as similar infrastructure may re-emerge.