sparklesprints[.]com[.]ng

The domain sparklesprints.com.ng is currently active and has been classified as a credential phishing site. The site presents the page title "Login - SPARKLEZ PRINTS LTD" and returns an HTTP 302 status code, indicating a redirect likely used to capture credentials. DNS resolution points to IP address 163.61.188.7, which is geolocated to the United States and associated with the MIT network. The domain uses a Let's Encrypt certificate (YR1) for TLS encryption. Infrastructure details show four authoritative name servers: dns1.lytehosting.com, dns2.lytehosting.com, dns3.lytehosting.com, and dns4.lytehosting.com. Registration was performed through the registrar Leads Globe. Threat intelligence sources list the domain on one security blocklist and note that PhishDestroy has already blocked it. AlienVault OTX references the domain in two separate pulses, and VirusTotal analysis shows five of ninety‑one security vendors flagging the domain. The available data confirms the presence of a credential‑phishing campaign targeting users of SPARKLEZ PRINTS LTD, but the specific phishing kit or exact credential capture mechanism has not been disclosed. Defenders should block the domain and its associated IP at network perimeter devices, monitor DNS queries for the listed name servers, and update endpoint protection signatures to reflect the five VirusTotal detections. Continuous observation of the domain’s activity is advised, as further indicators may emerge.