enroll-sparkdex[.]xyz

This domain, enroll-sparkdex.xyz, is flagged as a high-risk brand impersonation threat targeting users of SparkDEX, a decentralized exchange on the Flare Network. Analysis indicates the site is designed to deceive visitors into believing it is the legitimate SparkDEX trading platform, likely with the intent to facilitate fraudulent investment schemes or crypto asset theft. The page title, 'SparkDEX - Best DEX on Flare Network | Flare Dex Trading Platform,' directly mirrors the branding of the authentic service, increasing the likelihood of successful social engineering attacks against unsuspecting users. Infrastructure analysis reveals the domain was registered on June 22, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to IP address 172.67.222.181, hosted on Cloudflare’s network (AS13335) in the United States. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy. VirusTotal detection shows 3 out of 95 security vendors have flagged the domain as malicious. The domain appears on three independent security blocklists, and it is actively blocked by multiple threat intelligence platforms, including MetaMask and SEAL. As of the latest assessment, enroll-sparkdex.xyz remains active and poses a significant risk to users. The combination of brand impersonation, recent registration, and low but consistent detection rates suggests an ongoing campaign. Users are advised to avoid interacting with the domain, verify URLs through official channels, and report the site to relevant abuse contacts. Organizations should update blocklists and monitor for related infrastructure, as this domain may be part of a larger fraud network leveraging similar naming conventions.