luckyspire[.]top

The domain luckyspire.top was registered on 21 February 2026 through Dynadot LLC and remains active as of the 12 July 2026 assessment. The site presents a HTTP 200 response with the page title “Redirecting…”, indicating a likely interim forwarding mechanism rather than a static landing page. The domain is currently listed on a security blocklist and is explicitly blocked by PhishDestroy, supporting its classification as a malicious resource.

Infrastructure analysis shows the domain resolves to the IP address 188.114.97.3, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. DNS resolution is handled by the authoritative name servers ns1.oh313.parklogic.com. and ns2.oh313.parklogic.com. The web server stack reports Nginx with OpenResty, and the TLS certificate is issued by Let’s Encrypt (R12). A Gridinsoft trust score of 1 out of 100 further reflects the low credibility of the host.

The observed characteristics align with a survey or prize‑based phishing campaign, a type confirmed by the provided scam classification. The “Redirecting…” title suggests the site may be used to forward victims to additional malicious pages after capturing initial data. However, the lack of publicly available payload samples or detailed page content limits the ability to confirm the exact phishing flow or credential collection mechanisms employed.

Defenders should block any network traffic to luckyspire.top and its associated IP address, and incorporate the domain into URL filtering and sink‑hole policies. Continuous monitoring of the Cloudflare edge IP for changes is advised, as the attacker could shift to alternate addresses within the same AS. Incident response teams should also review logs for prior accesses and consider user education about unsolicited survey or prize offers that redirect through unknown domains.