socialspark[.]fun

Analysis of the domain socialspark.fun, created on February 21, 2026, indicates an active fake‑airdrop campaign targeting Revolut users. The site presented the title “SocialSpark - Ignite Your Social, Earn Your Rewards” but offered no valid SSL certificate, leaving the HTTP service unencrypted. Infrastructure inspection shows the domain resolves to IP 216.198.79.1, hosted within Amazon’s AS16509 network in the United States, and uses generic parking name servers (ns1.dns-parking.com, ns2.dns-parking.com).

Registration was performed through Hostinger operations, UAB, and the domain received a Gridinsoft trust score of 0 / 100, reflecting a high confidence of malicious intent. Two of ninety‑three VirusTotal scanners flagged the domain, and it appears on one external security blocklist, confirming detection by multiple vendors. PhishDestroy has already taken the site offline, and the current HTTP status is reported as taken offline.

While the page content beyond the title has not been captured, the combination of a brand‑impersonation tag (Revolut), the “Fake Airdrop” scam type, low trust scoring, lack of TLS, and observed detections provides sufficient evidence for defensive action. Organizations should block socialspark.fun at DNS and proxy layers, add the associated IP address to threat‑intel feeds, and monitor for email subjects referencing airdrops or rewards that reference Revolut. Security teams should also update URL filtering rules in web gateways to deny traffic to this host and consider sharing the indicator set with industry information‑sharing groups to accelerate broader mitigation.