cloudspire[.]cash

PhishDestroy identifies cloudspire.cash as an active crypto-drainer phishing domain mimicking the legitimate Cloudspire brand. The site employs a drainer kit designed to siphon cryptocurrency assets from unsuspecting victims who connect their wallets. Current analysis indicates this is a generic phishing operation without ties to a specific wallet drainer variant, though the infrastructure suggests opportunistic targeting of crypto users. This domain was registered through GNAME.COM PTE. LTD. on February 28, 2026, and resolves to IP address 188.114.96.3. It utilizes a Let's Encrypt SSL certificate for obfuscation and remains undetected on VirusTotal with a clean score of 0 detections out of 95 scanners. Google Safe Browsing (GSB) has not flagged the domain, and no third-party blocklists currently include it. The domain's recent creation date and lack of detection underscore the need for proactive monitoring. As of this analysis, cloudspire.cash remains active and continues to serve its malicious content. PhishDestroy recommends immediate blocking of this domain and IP at the network perimeter. Users who may have interacted with the site should revoke any connected wallet permissions and verify transaction histories. While current risk is classified as 'under_investigation,' the absence of detections suggests a rapidly evolving threat that could escalate without intervention.