sparkdex[.]vote

This domain, sparkdex.vote, is identified as a crypto drainer phishing site targeting cryptocurrency wallet credentials and funds. Currently, the domain is offline, but prior analysis indicates it was actively serving malicious content designed to drain digital assets from unsuspecting users. No specific brand impersonation has been confirmed, though the infrastructure aligns with common tactics used in cryptocurrency-related fraud schemes. Infrastructure analysis reveals the domain was created on May 24, 2026, and registered through Netdorm, Inc. dba DnsExit.com. It resolves to the IP address 104.26.13.30, which is protected by Cloudflare, a common obfuscation technique used to evade detection. The domain appears on one security blocklist and is flagged by PhishDestroy, though VirusTotal reports zero detections out of 95 vendors (0/95). The SSL certificate is issued by Let’s Encrypt, a legitimate provider often exploited by threat actors to lend false credibility. The page title, 'Just a moment...,' is consistent with Cloudflare’s default challenge page, suggesting attempts to bypass automated security scans. The current status of sparkdex.vote is offline, but the domain remains a latent threat due to its recent creation and association with cryptocurrency fraud. Users are strongly advised to avoid any interaction with this domain or its associated IP address. Organizations should update blocklists to include the domain and IP, monitor for related phishing campaigns, and educate users on recognizing crypto drainer tactics. Given the domain’s registration details and infrastructure, further monitoring is recommended to assess potential resurgence or migration to alternative domains.