sparkfi[.]us

Analysis of the domain sparkfi.us indicates a confirmed wallet seed phishing operation impersonating the Spark brand, as documented in threat intelligence records dated July 25, 2026. The domain was registered on February 21, 2026, and resolved to IP address 172.67.170.105, hosted on AS13335 (Cloudflare, Inc.) in the United States. The page title, 'Spark: Earn on your stablecoins,' directly references Spark, a known target of this impersonation campaign, and aligns with the reported scam type of wallet or seed phishing. Infrastructure analysis reveals the domain is currently offline, though it was actively blocked by two security vendors: PhishDestroy and ScamSniffer.

It appears on two security blocklists, and three of 93 security vendors on VirusTotal flagged the domain as malicious. The domain holds a Gridinsoft trust score of 0 out of 100, further indicating its high-risk nature. The SSL certificate is issued under the WE1 root, a common but not inherently malicious certificate authority. Defenders should treat this domain as a confirmed phishing threat targeting cryptocurrency users.

The combination of brand impersonation, wallet phishing classification, and detection by multiple security vendors justifies an elevated risk assessment. While the domain is currently offline, historical DNS and WHOIS records should be preserved for forensic purposes, and any residual DNS caching or proxy configurations should be reviewed to prevent accidental exposure. No additional page content or phishing kit details are available at this time.