spark[.]fi-wailet-dappv2[.]com

This domain, spark.fi-wailet-dappv2.com, is actively flagged as a DeFi scam targeting cryptocurrency users. Infrastructure analysis reveals the domain was registered on February 21, 2026, through MAT BAO CORPORATION and currently resolves to 188.114.96.3, an address assigned to Cloudflare, Inc. under AS13335. The site presents a 521 error indicating server downtime, though a 403 HTTP status suggests access restrictions may be in place, potentially masking active phishing operations. The page title explicitly reads 'fi-wailet-dappv2.com | 521: Web server is down,' which aligns with known patterns of temporarily disabled or obfuscated phishing infrastructure. The SSL certificate is issued by Cloudflare TLS Issuing ECC CA 3, a legitimate provider, which does not mitigate the domain's malicious intent but does indicate the use of standard encryption practices to avoid detection. Two security blocklists, including PhishDestroy and ScamSniffer, have already classified this domain as malicious, and a Gridinsoft trust score of 0/100 further corroborates its high-risk status. Nameservers are hosted under Cloudflare (major.ns.cloudflare.com and tessa.ns.cloudflare.com), a common tactic to leverage the provider's reputation while concealing the true hosting origin. What remains uncertain is the full extent of the phishing kit's functionality, as the current downtime or access restrictions prevent direct inspection of the site's content. However, the domain's registration details, resolution to a Cloudflare IP, and prior detection by security vendors provide sufficient evidence to classify it as an active threat. Defenders should treat this domain as compromised and implement immediate blocking measures at the DNS or network level. Monitoring for changes in HTTP status codes or SSL certificate updates may reveal when the site resumes active phishing operations, as downtime is often temporary in such campaigns.