spiritgiftclub[.]com

spiritgiftclub.com is currently listed as offline but was actively flagged by multiple security sources during July 2026. The domain was registered on 23 February 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare‑owned address 185.158.133.1, which is geolocated to Poland (AS13335). The authoritative name servers are hugh.ns.cloudflare.com and pat.ns.cloudflare.com. The site served no TLS certificate, indicating that any HTTP traffic would be unencrypted.

VirusTotal recorded detections from two of ninety‑three antivirus engines, confirming that at least a minority of scanners identified malicious behavior. PhishDestroy has taken the domain offline and added it to its blocklist; the domain also appears on one additional public blocklist. The only observed content indicator is the page title “Spirit Halloween Early Access Quiz”, suggesting an attempt to impersonate the Spirit Halloween brand, likely to lure users into a credential‑harvesting flow or data‑exfiltration scheme. No further forensic details about the page markup, form fields, or redirect behavior have been published, leaving the exact phishing methodology uncertain.

Defenders should proactively deny any DNS resolution for spiritgiftclub.com, block outbound HTTP requests to its IP address, and monitor for similar Cloudflare‑hosted domains that share the same registrar or naming pattern. Continuous re‑evaluation of VirusTotal and other sandbox reports is advised, as additional detections may emerge. Network teams should also consider tightening egress filtering to prevent users from reaching newly registered domains that resolve to high‑risk ASNs such as Cloudflare. The combination of recent registration, absence of TLS, limited detection signals, and the brand‑specific page title constitute a credible indicator of a targeted phishing campaign aimed at Spirit Halloween customers.