vote-sparkdex[.]com

PhishDestroy identifies vote-sparkdex.com as an active brand impersonation threat targeting SparkDEX, a Flare Network decentralized exchange (DEX). This domain masquerades as the legitimate SparkDEX platform to deceive users into depositing cryptocurrency under false pretenses. The threat employs classic impersonation tactics, leveraging the brand’s reputation to lure victims into fraudulent investment opportunities. No drainer kit has been confirmed in this specific campaign, but the infrastructure strongly suggests the use of social engineering to harvest credentials or facilitate unauthorized transactions.

This domain exhibits several technical red flags consistent with emerging phishing operations. VirusTotal currently flags the site with 1/95 detections, indicating it remains undetected by most antivirus engines as of analysis time. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to IP address 104.21.44.115. The domain was created on April 23, 2026, and currently shows no presence on Google Safe Browsing (GSB) or major public blocklists. These characteristics suggest a recently deployed, possibly automated campaign designed for short-term exploitation.

As of this assessment, vote-sparkdex.com remains active and unblocked. The low detection rate and absence from blocklists indicate a window of opportunity for the threat actor. Users are strongly advised to avoid interacting with this domain and verify all DEX platforms through official channels. The current risk level is under investigation but classified as active due to the domain’s operational status. Security teams should monitor for related infrastructure and update detection rules accordingly. Remaining risk is moderate given the domain’s recent creation and unblocked status, but containment is feasible with proactive blocking.