spinvault[.]us

The domain spinvault.us was registered through NameCheap on 2025-09-02. It resolves to 172.67.158.7, an address owned by Cloudflare (ASN 13335) located in the United States. The authoritative nameservers are grace.ns.cloudflare.com and memphis.ns.cloudflare.com, indicating the site was served behind Cloudflare's edge network. No TLS certificate was observed, and the SSL status is reported as none, meaning connections would be unencrypted.

The page title returned from the HTTP response is "Spinvault: Most Popular Online Crypto Casino Based on Blockchain", which aligns with the listed scam type of a crypto casino. The site employed the publicly known Gambler Scam phishing kit, a template frequently used to lure victims into depositing cryptocurrency under false pretenses. Reputation scoring from Gridinsoft assigned a trust score of 1 out of 100, reflecting extreme malicious confidence. VirusTotal analysis recorded 14 detections out of 93 scanning engines, and the domain is listed on at least one security blocklist and has been blocked by the PhishDestroy sinkhole.

The current operational status is offline, but historical activity suggests it was actively serving malicious content prior to takedown. Uncertainty remains regarding the specific victim targeting methods, command‑and‑control infrastructure, or any exfiltration pathways, as no additional payload or network traffic details are available. Defenders should continue to block the IP address 172.67.158.7 and add spinvault.us to domain blocklists, monitor for any re‑hosting attempts on other Cloudflare‑protected domains, and enforce strict TLS inspection to detect future variants that may acquire valid certificates. Incident response teams should also review logs for outbound connections to the Cloudflare IP range during the active window and consider sharing indicators of compromise with threat‑share platforms to aid broader community protection.