spark[.]fi-dappv3-wailet[.]com

PhishDestroy has identified spark.fi-dappv3-wailet.com as a generic phishing domain with elevated risk, specifically designed as a crypto drainer to steal digital assets from decentralized finance users. The domain impersonates the legitimate Spark Finance protocol, tricking visitors into connecting their wallets and approving malicious transactions. At the time of analysis, the site was offline and displayed the error message 'fi-dappv3-wailet.com | 521: Web server is down', indicating the host server was unreachable.

Technical indicators reveal that the domain was created on February 21, 2026, and resolved to IP address 172.67.156.128. It was registered through MAT BAO CORPORATION and used an SSL certificate issued by Google Trust Services (WE1). VirusTotal flagged this domain with a score of 3 out of 95 security vendors, and it appeared on 2 security blocklists. Google Safe Browsing did not list the domain at the time of analysis, but the low detection rate suggests the threat may have been newly deployed or evading initial scans.

The current status of spark.fi-dappv3-wailet.com is offline, meaning the phishing site is no longer accessible. However, this does not eliminate the risk entirely, as the attackers may relaunch the domain under a new IP or registrar. Users who may have previously interacted with the site should revoke any token approvals granted and monitor their wallets for unauthorized transactions. PhishDestroy recommends blocking the domain at the network level and adding it to blocklists to prevent future access. Remaining risk is moderate, as the infrastructure could be reactivated, and users who visited the site while it was live may still be compromised.