spookwin[.]com

Analysis of spookwin.com shows that the domain is currently active and returns HTTP 200 responses, indicating that a web server is reachable. The authoritative name servers are charles.ns.cloudflare.com and faye.ns.cloudflare.com, confirming that the infrastructure is hosted behind Cloudflare’s CDN and DDoS mitigation service. Registration information lists Fewmoretaps OU d/b/a Trustname.com as the registrar, a detail that aligns with other observed malicious registrations. The domain appears on three independent security blocklists and has been flagged by multiple threat‑intelligence providers, including PhishDestroy, MetaMask, and SEAL, which have each added it to their phishing mitigation feeds.

VirusTotal scans show that 18 of 91 security vendors have classified the domain as malicious, providing additional corroboration of its abusive nature. Despite the presence of mitigation services, the site remains reachable, and no evidence of takedown or remediation has been observed as of the report date (July 28 2026). No page title, brand identifier, or specific phishing lure has been disclosed in the available intelligence, so the exact impersonated target cannot be confirmed at this time.

Defenders should treat spookwin.com as a high‑risk phishing source. Recommended actions include adding the domain to DNS‑based and proxy‑based blocklists, enforcing URL filtering for all outbound traffic, and monitoring for any resolution attempts to the associated Cloudflare name servers. Continuous re‑evaluation of the domain’s status is advised, as threat actors may modify the payload or host page content without changing the underlying infrastructure.