spinlox[.]com

PhishDestroy identifies spinlox.com as an active credential harvesting domain under investigation, posing a credible phishing threat to unsuspecting users.

This domain exhibits clear indicators of compromise, including a generic SSL certificate issued by Let's Encrypt, registration through Fewmoretaps OU (d/b/a Trustname.com), and resolution to IP address 188.114.97.3. The domain was created on April 09, 2026, and currently shows 0 detections out of 95 scanners on VirusTotal, indicating it has evaded detection by traditional antivirus engines. Additionally, no entries in major threat intelligence blocklists (e.g., URLVoid, PhishTank, OpenPhish) have been recorded at this time, further underscoring its recent emergence and the need for heightened scrutiny.

Given the active status of this domain and its association with credential harvesting, organizations and users should immediately block spinlox.com at the network perimeter and DNS level. Security teams are advised to monitor for any instances of this domain being used in phishing lures, particularly in emails impersonating trusted brands or services. End-users should exercise extreme caution, avoid interacting with the domain, and report any suspicious communications to their security teams. A full forensic analysis is recommended to trace any potential data exfiltration or lateral movement if this domain has been accessed within your environment.