sparkfinland[.]fi

Analysis of sparkfinland.fi indicates that the domain was created on March 28, 2017 and remains active as of the report date, July 28, 2026. The domain is registered through Planeetta Internet Oy and uses the nameservers ns1.domainhotelli.fi and ns2.domainhotelli.fi. DNS resolution points to the IP address 31.217.196.241, which is the sole host observed for this indicator. The domain has been scanned by 91 VirusTotal vendors; none of the vendors have reported a detection at the time of scanning, though the absence of detections does not constitute a safety guarantee.

The domain is currently blocked by the PhishDestroy service and appears on a single external security blocklist, suggesting that at least one threat‑intelligence feed has flagged it as malicious. No additional data such as SSL certificate details, HTTP response codes, Safe Browsing status, or page title have been disclosed, leaving the content and exact phishing tactics employed by the site unverified. The lack of publicly available page metadata means that the specific brand or service being impersonated cannot be confirmed.

Defenders should continue to monitor the domain for any changes in hosting, DNS configuration, or detection status. It is advisable to add the domain and its associated IP address to internal blocklists, enforce outbound filtering for connections to the IP, and incorporate the domain into email gateway reputation checks. Ongoing re‑scans with VirusTotal and periodic queries to blocklist providers are recommended to capture any future malicious activity associated with sparkfinland.fi.