Loading… Access QueueAutomatic checkYour request is in progressAccess is being verified and your page will open automatically.1Request receivedDone2Access checkLive3Page deliveryNext
Model notes
The page content 'Loading… Access QueueAutomatic checkYour request is in progressAccess is being verified and your page will open automatically.1Request receivedDone2Access checkLive3Page deliveryNext' does not provide enough information to assess the site's purpose or intent.
Automated reading of the page content, not a manual finding.
Results reflect each source’s collection time. Zero detections do not guarantee safety. OTX references are community publications.
ネットワークセキュリティインテリジェンス Registrar context
Registrar contextTrustname
Stored registration data identifies Trustname / Fewmoretaps OÜ (IANA 4318) as the registrar. PhishDestroy maintains a separate registrar investigation; that material is contextual and is not an independent detection for this domain.
spark-spend.com is a suspicious domain on the PhishDestroy blocklist, and the wallet-focused MetaMask and SEAL blocklists list it as well. No impersonated brand has been confirmed. PhishDestroy first saw it on 2026-10-13, and the site has been offline since that same day. As of 2026-10-19 it is still down, and its hosting provider has blocked the content.
How the scam works
The page title only shows a Cloudflare "520: Web server is returning an unknown error" message, so it reveals nothing about what the site displayed while it was live. That error page does not match our blocklisting, which rests on the domain's listings rather than on visible content. Two crypto-security blocklists flagged it, which points to a risk aimed at wallet users. Sites like this typically ask visitors to connect a wallet, sign transactions or enter a recovery phrase, and any of those steps can hand over control of funds. No specific scheme has been confirmed for this domain.
Evidence
VirusTotal scanned the domain on 2026-10-13, and none of its 92 engines flagged it. That clean result is common for very new crypto threats, which conventional antivirus feeds often miss. Support comes from blocklists built for crypto phishing instead. PhishDestroy, MetaMask and SEAL all list the domain, and it appears in two AlienVault OTX threat pulses.
Infrastructure
The domain was registered on 2026-10-03 through Fewmoretaps OU d/b/a Trustname.com, ten days before PhishDestroy detected it. That short gap between registration and detection is typical of throwaway domains set up for a single campaign. It resolves to Cloudflare's network (AS13335, US), so the public address belongs to Cloudflare's proxy and does not reveal the server behind it. The provider has since blocked the content.
What to do
If you visited spark-spend.com and connected a wallet, use a token-approval checker to review the permissions you granted and revoke any you do not recognize. If you entered a seed phrase or private key, assume that wallet is compromised and move your remaining assets to a new wallet created on a clean device. Do not return to the domain if it comes back online, and treat new lookalike domains with the same pattern as hostile. Defenders should block the domain at the DNS and proxy level and check logs for visits between 2026-10-03 and 2026-10-13. They should also report any related domains to the registrar and to Cloudflare.
spark-spend.com | 520: Web server is returning an unknown error
TLS証明書
発行者 YE1
Network & certificates
Stored technical evidence
Network & DNS
Shared CDN edge
Resolved IP
188.114.96.1
Network ASN
AS13335
Organization
Cloudflare, Inc.
Observed location
San Francisco, US
Server header
cloudflare
Edge-IP の評判はこのドメインに起因しません。
Location describes the IP network.
TLS証明書
Issuer
YE1
Collection source
PhishDestroy collector
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
A public ScamAdviser lookup is available. Review its current score and warnings at the source; the existence of a lookup page is not itself a malicious verdict.
Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(BY)
PhishDestroy Investigation
