spark-vote[.]xyz

Analysis of spark-vote.xyz as of August 04, 2026, confirms its classification as an active phishing domain. The domain appears on three distinct security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, indicating confirmed malicious activity. VirusTotal telemetry shows three of ninety-one security vendors flagging the domain, reinforcing its elevated risk status.

No additional infrastructure details, such as hosting provider, autonomous system number, or SSL certificate issuer, are currently available for further correlation. The exact content or targeted brand of the phishing site remains unconfirmed, as no page title, phishing kit, or specific scam type has been identified in the available intelligence. Defenders should treat this domain as hostile and enforce immediate blocking at the DNS, proxy, and endpoint layers.

Given its presence on multiple blocklists and detection by specialized anti-phishing vendors, organizations are advised to review logs for connections to this domain and investigate any associated credentials or sessions for compromise. No evidence suggests this domain is benign, and its continued operation warrants ongoing monitoring for shifts in infrastructure or attack patterns.