sparklab[.]sbs

Analysis of sparklab.sbs shows a high‑risk generic phishing infrastructure that was registered on April 22 2026 through Spaceship, Inc. The domain is hosted on Cloudflare’s network (IP 188.114.96.3, located in Canada) and uses Cloudflare nameservers jihoon.ns.cloudflare.com and saanvi.ns.cloudflare.com. The site presents a HTTP 502 response and serves a TLS certificate from Let’s Encrypt (E8). Reputation data is poor: Gridinsoft assigns a trust score of 0 / 100, the domain appears on three security blocklists, and it is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans report two of ninety‑four security vendors flagging the domain, and AlienVault OTX lists one associated threat pulse. The page title “Storytelling w blogu: Jak to zrobić?” is the only visible content indicator; no further page details have been disclosed. While the exact phishing lure is not yet confirmed, the combination of recent registration, low trust score, blocklist presence, and partial VirusTotal detections suggests a malicious intent. Defenders should add sparklab.sbs to deny‑list rules, monitor DNS queries for the domain, and consider sinkholing the associated IP address. Continuous re‑evaluation is advised as additional telemetry becomes available.