sparkdex[.]icu

PhishDestroy identifies sparkdex.icu as an active crypto drainer domain currently engaged in malicious activities targeting cryptocurrency users. This domain is weaponized to deceive victims into connecting their digital wallets under the guise of fraudulent token offerings or fake DeFi platforms, resulting in unauthorized fund drainage. The threat remains operational with a confirmed active status as of the latest analysis cycle.

This domain was flagged by 2 of 95 VirusTotal security vendors, indicating limited but concerning initial detection. It operates under a Let's Encrypt SSL certificate, utilizes IP address 188.114.97.3 hosted on infrastructure associated with NICENIC INTERNATIONAL GROUP CO., LIMITED, and was registered on May 03, 2026. Despite its recent registration, the low VirusTotal detection rate is atypical for such high-risk domains and may reflect evasion techniques or delayed vendor response. The SSL certificate leverages reputable issuance, which could be abused to enhance perceived legitimacy among potential victims.

Given the elevated risk profile and active operational status, sparkdex.icu should be classified as a high-priority threat requiring immediate containment. Analysts are advised to block this domain at the DNS and firewall levels. End users should be warned against visiting or engaging with the site due to its confirmed crypto drainer functionality. Continuous monitoring of this domain and its associated infrastructure is strongly recommended to detect lateral movement or campaign expansion. All cryptocurrency-related communications referencing sparkdex.icu should be treated as malicious and reported accordingly.