spinoo[.]win

spinoo.win was observed as an offline site on 24 July 2026. The domain was registered on 9 March 2026 through Gname.com Pte. Ltd. and is hosted behind Cloudflare, resolving to IP 104.21.64.180 located in Canada. The authoritative name servers are bob.ns.cloudflare.com and naomi.ns.cloudflare.com, and the TLS certificate is issued by Let's Encrypt (identifier E7). The page title returned by the HTTP response is “Spinoo: Most Popular Online Crypto Casino Based on Blockchain”, indicating a brand‑impersonation campaign that markets a fake crypto casino.

The underlying phishing kit is identified as the “Gambler Scam” kit. Reputation services assign the domain a trust score of 1/100 on both Scamadviser and Gridinsoft, reflecting extreme malicious confidence. The domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis shows a single positive detection out of 95 scanned engines, confirming at least one vendor flagged the domain.

Detected technologies include Twitter Ads, Facebook Pixel, Cloudflare Browser Insights, and the core Cloudflare service, suggesting the operators are leveraging common advertising and analytics tags to increase credibility. Given the combination of a newly created domain, low trust scores, presence on multiple blocklists, and the use of a known gambling‑themed phishing kit, defenders should treat spinoo.win as a high‑confidence phishing indicator. Recommendations include adding the domain and its resolved IP address to deny‑list rules, monitoring for any future re‑activation, and updating intrusion‑detection signatures that reference the observed technology stack. Continuous observation of the associated Cloudflare name servers is advised to detect potential redeployment of the infrastructure under a new domain.