spintrey[.]com

PhishDestroy identifies spintrey.com as an active crypto drainer domain designed to facilitate credential theft and unauthorized cryptocurrency transactions. This domain impersonates legitimate services to deceive users into connecting their wallets or entering sensitive credentials, which are then exploited to siphon digital assets. The threat actor behind this domain employs a drainer kit tailored to intercept wallet connections and extract private keys or transaction approvals, posing a significant risk to cryptocurrency holders. This domain resolves to IP address 188.114.97.3 and is associated with a Let's Encrypt SSL certificate, adding a veneer of legitimacy. Registered through Fewmoretaps OU d/b/a Trustname.com on April 04, 2026, this domain is flagged by 4 out of 95 security vendors on VirusTotal, indicating a moderate detection rate. While Google Safe Browsing (GSB) status remains unconfirmed, the domain has likely evaded widespread blocklisting due to its recent creation and low-profile registration. The combination of a fresh registration date, limited vendor detection, and association with a crypto drainer kit suggests an opportunistic threat actor leveraging newly registered domains for short-lived campaigns. As of this advisory, spintrey.com remains active and poses an elevated risk to users interacting with cryptocurrency platforms. Immediate action includes blocking the domain at the network perimeter and endpoint levels, as well as updating firewall rules to prevent outbound connections to 188.114.97.3. Users should be alerted to avoid engaging with this domain and to verify any unsolicited links or communications purporting to originate from cryptocurrency services. Threat hunters are advised to monitor for additional domains registered through Trustname.com or resolving to the same IP, as these may indicate a broader campaign. Remaining risk is elevated due to the domain's active status and the potential for rapid evolution in the drainer kit's functionality.