spark-fi[.]cfd

Analysis of spark-fi.cfd indicates that the domain is associated with a generic phishing campaign and is currently offline. The domain was registered on February 21, 2026 and resolves to the IPv6 address 2606:4700:3036::ac43:a714, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. Reputation services have identified the domain on two independent security blocklists and it is explicitly blocked by the PhishDestroy and ScamSniffer filtering platforms.

A Gridinsoft trust score of 0 out of 100 further confirms the lack of legitimacy. VirusTotal scans show that eleven of ninety‑five antivirus engines flag the domain as malicious, reinforcing the phishing classification. The SSL certificate presented for the site is identified as "WE1," a certificate that has been observed on other low‑reputation hosts.

No public page title, brand target, or content snapshot is available, so the exact visual or credential‑capture mechanisms remain unknown. Defenders should continue to block traffic to the IPv6 address and the domain name at network borders, update any internal URL filtering lists with the observed blocklist entries, and monitor for potential re‑registration or new resolution to alternative IP space. Because the domain is presently taken offline, threat actors may attempt to relaunch the campaign using a different domain; ongoing reconnaissance of related infrastructure and periodic re‑scanning of the domain are recommended to detect any resurgence promptly.