wylderhotels[.]sparkaxis[.]org

This domain, wylderhotles.sparkaxis.org, is identified as a generic phishing site designed to harvest user credentials through deceptive login portals. Analysis indicates no direct association with known brand impersonation campaigns or drainer kits, though its infrastructure and registration patterns align with opportunistic credential theft operations. The domain presents a 404 Not Found error page, suggesting either a takedown, staging environment, or abandoned post-compromise infrastructure. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 13 out of 95 security vendors on VirusTotal, indicating moderate detection coverage. It was registered through Spaceship, Inc. on April 27, 2026, with a future creation date that may reflect backdating or administrative error. The domain resolves to IP address 172.67.184.96, a Cloudflare-hosted endpoint leveraging HTTP/3 and HSTS protocols for encrypted communication. It appears on one security blocklist and is currently blocked by PhishDestroy. No Google Safe Browsing (GSB) entries were recorded at the time of analysis. The domain is currently offline, reducing immediate risk of active credential harvesting. However, residual threats persist due to its presence on security blocklists and historical detection by multiple vendors. Organizations should maintain blocking rules for this domain and its associated IP address (172.67.184.96) to prevent potential reactivation. Security teams are advised to monitor for related domains registered under the same registrar or resolving to the same infrastructure, as threat actors often reuse hosting providers and IP ranges across campaigns.