spark-relayer[.]xyz

This domain, spark-relayer.xyz, is identified as a brand_impersonation phishing site targeting WalletConnect, a widely used protocol for connecting cryptocurrency wallets to decentralized applications. The site masquerades as a legitimate RPC restoration service, using the page title 'RPC Restore - Optimize Your Wallet Connection' to deceive users into interacting with malicious infrastructure. No specific drainer kit has been conclusively linked to this domain, but the impersonation tactics align with common cryptocurrency phishing campaigns designed to harvest credentials or private keys. Analysis indicates the domain was registered on November 08, 2025, through Web Commerce Communications Limited. It resolves to the IP address 172.67.166.132, a hosting provider commonly associated with content delivery networks. VirusTotal reports 4 out of 95 security vendors flagging this domain as malicious, while it appears on two independent security blocklists. Gridinsoft assigns a trust score of 0/100, further corroborating its classification as high-risk infrastructure. The domain is not currently listed in Google Safe Browsing databases, though this may reflect a lag in detection rather than benign status. As of the latest assessment, spark-relayer.xyz has been taken offline, likely in response to detection by security platforms. Despite its inactive status, residual risk persists due to the potential for domain reactivation or migration of the phishing infrastructure to new addresses. Users who interacted with the site prior to takedown should assume credential exposure and take immediate remedial actions, including revoking wallet permissions, rotating private keys, and monitoring for unauthorized transactions. Organizations maintaining blocklists or threat intelligence feeds are advised to retain this domain in their databases for at least 90 days to account for potential re-emergence.