Spirit Airlines Liquidation: An Active Azure Endpoint, An Exposed Booking Flow, and $11.48 Domains A look at Spirit Airlines' abandoned but active web infrastructure after their sudden liquidation, and 3 defensive registrations that received immediate traffic. Brayden Hustead May 02, 2026 Share As Spirit Airlines officially ceased operations on May 2, 2026, a multi-billion-dollar corporate infrastructure was abandoned in real-time. I discovered their exposed booking flow that still processes transactions, a live Azure API still issuing valid flight records, and a primary phishing domain, spiritrefunds.com, available for the default registration price of $11.48. This is my deep dive into the chaos of Spirit Airlines’ zombie infrastructure. To anyone affected by the canceled Spirit Airlines flights: Please visit www.spiritrestructuring.com/guests for the latest information about the bankruptcy case. Hi, my name is Brayden Hustead. I’m a Computer Science student and, on occasion, I dive deep into interesting tech topics. As I haven’t seen anyone else cover this, I thought sharing my discoveries would be valuable. TL;DR: Spirit Airlines’ approach to facilitating its “orderly wind-down of our operations, effective immediately” on its web infrastructure was to apply a root path redirect at spirit.com/ to the bankruptcy information website and call it a day. Not only does the booking flow still work by using internal page links to reach the “BOOK” form, but the Navitaire API is also still active on Azure, allowing payments to continue being processed. Payments for services that cannot be provided to an entity that is no longer a functioning business. Further demonstrating this panicked approach, very predictable phishing domains such as spiritliquidation.com, spiritrefunds.com, and spiritrefund.com were left exposed and available on any consumer registrar for malicious use. I registered these 3 domains and redirected them to the official liquidation page to help combat the likely mass scams resulting from the promised flight refunds. Using statistics from my redirect on spiritliquidation.com, I found 43 visits that appear to be likely human traffic. As this domain was not published anywhere, these are real people in real despair about their canceled flights, searching for any available information. Legal notice: Spirit Airlines’ designated bankruptcy contacts have already been informed, and I am prepared to transfer ownership to the appropriate person. How I discovered these major failures: On May 2, 2026, Spirit Airlines announced an immediate “orderly wind-down” of operations. During this transition, their technical infrastructure was obviously duct-taped together to handle the world's panic. I learned about this story this morning when my mom informed me. As my sister was among those affected by the canceled flights, I took a keen interest in how an entity of that size would be dissolved. As a Computer Science major and Cybersecurity minor, I immediately experimented with the spirit.com and spiritrestructuring.com websites. I would like to add, for the record, that as of the initial publication of this post, my sister has not received a single email from Spirit. No cancellation email, no announcement to account holders, nothing leading up to or after the announcement. Other than third-party news outlets, the only indicator of her flight’s cancellation was a lazy pop-up in the mobile app that never directly stated Spirit Airlines is being liquidated. Originally, I suspected Spirit would use the flight database to assist with flight cancellation emails; however, my discoveries in this post very likely explain the lack of emails: the flights were never canceled in the database. In fact, the flights are still bookable? Transparency Notice: My research was assisted by Google Gemini 3 Fast. All presented information, including research into Spirit’s processes, was fact-checked authentically. Duct-Tape Redirection I discovered that their “Refund Status” link points directly back to their existing Spirit account system. Using this connection back to the original website, I discovered that the root directory www.spirit.com/ is still accessible by clicking “BOOK” in the header, but clicking the Spirit logo or browsing to spirit.com directly redirects to the “restructuring” website. Evidently, Spirit’s IT teams pushed a redirect at the CDN edge for the root path, but, as they had very little time (or pay, given the bankruptcy's status) to do cleanup work, the internal links within the spirit.com route were left unmodified. Further, from the Spirit homepage, I was able to search for a flight and view the latest availability and pricing status from their database’s most recent cache. This is where it gets interesting. (For the record, this is an entirely abstract flight plan. I made it up.) Flight Bookings Are Still Open? I’ll be honest, this is where I thought my site manipulation would end. In my initial testing, I misrea...
The article describes a post-liquidation infrastructure exposure, not a software vulnerability, so a CVSS score, affected versions, or a fixed version are not applicable. The threat involves abandoned but still-active Azure endpoints and booking flows that continue to process payments, alongside predictable phishing domains that were left unregistered. A workaround for similar organizational wind-downs would be to decommission all public-facing services and APIs immediately and defensively register high-risk domain names.