spark[.]fi-app-v2-connect-wallet[.]info

Analysis of spark.fi-app-v2-connect-wallet.info indicates a newly registered domain that has been used for a brand‑impersonation campaign targeting Metamask users. The domain was created on 21 February 2026 and resolves to the IP address 172.67.131.253, which belongs to Cloudflare, Inc. (ASN 13335) and is geolocated in the United States. The site presented the page title “Spark: Earn on your stablecoins”, a phrasing that aligns with the declared scam type of a crypto‑related scam. The SSL certificate is identified as “WE1”, confirming that HTTPS is in place, but the certificate details are otherwise unremarkable.

The domain has been flagged by multiple detection sources: two of ninety‑five VirusTotal scanners raised alerts, it appears on a single public blocklist, and the Gridinsoft trust score is 0 / 100, indicating a high likelihood of malicious intent. PhishDestroy has actively blocked the domain, and the current HTTP status is offline, suggesting that the malicious infrastructure has been taken down or is no longer serving content. Evidence confirms that the campaign impersonates the Metamask brand, but the exact content of the landing page has not been captured beyond the title; therefore, visual or functional characteristics remain unknown. Defenders should update their URL filtering rules to include the full domain and the associated IP range, enforce blocklisting of 172.67.131.253, and monitor for any future subdomains that may be provisioned under the same Cloudflare edge network.

Network‑level indicators such as the ASN and country should be added to threat‑intel feeds to improve detection of similar crypto‑scam infrastructure. Because the domain is already offline, immediate incident response may focus on confirming that no credential harvesting occurred and reviewing any endpoint logs for connections to the IP address during the active window.