sparkdexvote[.]app

This domain, sparkdexvote.app, is identified as an active cryptocurrency phishing site designed to harvest wallet credentials through fraudulent login interfaces. The threat type is classified as generic_phishing with a high-risk level, and the page currently displays a Dutch-language placeholder title, 'Even geduld...,' suggesting preparation for a targeted campaign. No legitimate brand impersonation has been confirmed, but the infrastructure aligns with common cryptocurrency phishing tactics. Analysis indicates the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.). The SSL certificate is issued by Let's Encrypt (YE2), a common choice for both legitimate and malicious sites. Security vendors have flagged the domain, with 3 out of 95 VirusTotal engines detecting it as malicious. Additionally, it appears on three security blocklists, including those maintained by PhishDestroy, MetaMask, and SEAL. The creation date of May 30, 2026, is anomalous, as it predates the current date, likely indicating domain squatting or a registration error. The domain remains active as of the latest verification, posing an ongoing risk to users who may encounter it through phishing links or malicious advertisements. Organizations and individuals are advised to block the domain at the network level and add its IP (188.114.96.3) to firewall deny lists. Users should verify wallet addresses and login pages independently before entering credentials, and security teams are recommended to monitor for related indicators of compromise, such as the domain's SSL certificate thumbprint or associated registrar details.