spinha[.]app

The domain spinha.app is currently listed on a security blocklist and has been flagged by three of ninety‑one VirusTotal scanners as malicious. Automated analysis shows the site returns HTTP 200, indicating an active web server that can deliver payloads or fraudulent pages. The domain resolves to Cloudflare’s infrastructure, using the authoritative nameservers houston.ns.cloudflare.com and kay.ns.cloudflare.com, a pattern commonly observed for CDN‑based phishing operators. Registration records indicate the domain was created through GNAME.COM PTE.

LTD., but no further registrant details are disclosed. Defensive feeds such as PhishDestroy have already added spinha.app to their blocklists, confirming its classification as a phishing resource. The limited detection footprint—only three vendor detections—suggests the site may be newly deployed or employing evasion techniques that avoid broader detection. At present, no additional intelligence such as page title, target brand, or malware kit has been published, leaving the exact content of the hosted pages unknown.

Analysts should treat the domain as high‑risk and enforce network‑level blocking, DNS sinkholing, or proxy filtering to prevent user access. Continuous monitoring of Cloudflare name‑server changes and periodic re‑scanning on VirusTotal are recommended to capture any escalation in malicious activity. Organizations that rely on email or web gateways should ensure that signatures for spinha.app are incorporated into existing phishing protection rules.