sparkdex[.]io

Analysis of sparkdex.io shows a short‑lived domain that was created on February 21, 2026 and is currently taken offline. The site resolves to the IP address 188.114.97.3, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. No SSL certificate is presented, indicating that the site was served over plain HTTP. The page title returned by the server is "Nur einen Moment…", a German phrase meaning "Just a moment…", but the content of the page has not been publicly examined, so the exact lure or credential‑capture mechanism remains unknown.

The domain appears on two independent phishing blocklists, PhishDestroy and ScamSniffer, and has been flagged by six of ninety‑three VirusTotal scanners, reinforcing the suspicion of malicious intent. Gridinsoft assigns the domain a trust score of zero out of one hundred, reflecting a severe lack of reputation. Registration was performed through the generic .io TLD registry, providing no additional ownership clues.

Defenders encountering traffic to sparkdex.io should block the domain at perimeter filters, enforce DNS sinkholing, and monitor for any outbound connections to the associated Cloudflare IP. Because the site is offline, immediate threat exposure is limited, but the infrastructure indicates a typical fast‑flux style phishing deployment that could be reused with new payloads. Continuous observation of the IP address and related Cloudflare ranges is advised, as attackers often recycle the same hosting assets for subsequent campaigns.