sparkdex[.]co[.]com

Analysis of sparkdex.co.com indicates active brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. The domain, registered through Moniker Online Services LLC, resolves to IP 188.114.97.3 and is currently flagged on four security blocklists, including SEAL, MetaMask, PhishDestroy, and BLP-Malware. The page title, 'SparkDEX — The Next-Generation DEX on XRP Ledger | SparkDEX XRPL,' explicitly references the XRP Ledger, a detail consistent with cryptocurrency-themed phishing campaigns. Infrastructure analysis reveals the use of Cloudflare, including HTTP/3 and Cloudflare Browser Insights, alongside HSTS implementation, suggesting an attempt to appear legitimate while leveraging protective measures to evade takedowns. Three of 95 security vendors on VirusTotal have flagged the domain, though this detection rate is not conclusive evidence of malicious activity on its own. The domain remains active as of July 12, 2026, and employs a Let's Encrypt SSL certificate, a common tactic to avoid browser warnings. No evidence of a specific phishing kit or additional payload delivery has been confirmed at this time. Defenders should treat this domain as high-risk, particularly in environments involving cryptocurrency transactions or Ledger-related services. Blocking the domain and its resolving IP at the network level is recommended until further analysis or takedown occurs.