spinhartaplus[.]com

PhishDestroy identifies spinhartaplus.com as an active phishing domain impersonating the legitimate SpinHart brand to deploy a drainer kit that siphons cryptocurrency from victim wallets. The landing page mimics the official SpinHart interface, luring users into connecting wallets and authorizing malicious token transfers. No known antivirus signatures currently detect samples tied to this domain, indicating a newly emerged campaign that evades traditional defenses.

This domain was flagged by PhishDestroy on August 10 2025, with VirusTotal showing 0 detections out of 95 engines as of seed 969711. It resolves to IP 52.222.236.34, registered through NameSilo LLC, and holds a valid Amazon SSL certificate. Google Safe Browsing has not blacklisted the domain, and public blocklists show zero prior reports. The domain’s recent creation date and pristine reputation suggest a deliberate effort to bypass early detection mechanisms.

The threat remains active and under continuous monitoring by PhishDestroy. Immediate actions include blocking IP 52.222.236.34 and domain spinhartaplus.com at network and endpoint levels. Users are advised to avoid interacting with any SpinHart-related links received via unsolicited messages. While the current risk is elevated due to the drainer’s sophistication, active takedown efforts are ongoing; however, the risk is not fully mitigated until the campaign infrastructure is dismantled.