spark-fai[.]gr[.]com

On July 28, 2026, the domain spark-fai.gr.com was observed actively hosting a generic phishing campaign. The domain resolves to the Cloudflare‑managed address 104.21.51.89 and uses the authoritative name servers harvey.ns.cloudflare.com and liv.ns.cloudflare.com, indicating that the infrastructure is leveraging Cloudflare’s DNS and edge services. VirusTotal records show that one of ninety‑one scanned security vendors flagged the domain, suggesting at least a minimal detection signal.

The domain is presently listed on a single security blocklist and has been added to the PhishDestroy blocklist, confirming that at least one external mitigation service has taken action against it. No additional public intelligence such as Safe Browsing status, OTX tags, SSL certificate details, HTTP response codes, or page‑title metadata is available, leaving the exact content and target brand of the phishing page undocumented. The limited detection footprint combined with active status implies that the campaign may be in early deployment or operating with low visibility.

Defenders should block traffic to spark-fai.gr.com at network perimeter devices, update DNS filtering rules to include the domain, and monitor for any connections to the associated IP address 104.21.51.89, which may be shared with other malicious actors. Continuous re‑scanning with multi‑vendor services is recommended to capture any changes in detection status, and analysts should watch for future additions to blocklists or reputation feeds that could provide further context.