spark-updates[.]live

The domain spark-updates.live was registered on April 11, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently active. It is hosted behind Cloudflare infrastructure, resolving to IP address 172.67.210.202 located in Canada. DNS resolution uses the Cloudflare nameservers logan.ns.cloudflare.com and gabriella.ns.cloudflare.com, and the site presents a valid Let's Encrypt E7 TLS certificate. An HTTP request returns a 403 status code, and the page title displayed is "Just a moment...". Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal reports a single detection out of 94 scanning engines, indicating at least one vendor has flagged the domain as malicious. The domain appears on one security blocklist and is actively blocked by PhishDestroy. AlienVault OTX references the domain in one threat pulse, confirming its inclusion in existing threat intelligence feeds. The observed indicators collectively point to a credential phishing operation, consistent with the known scam type. While the specific target brand is not disclosed in the available data, the presence of a generic page title and the high‑risk rating suggest the site is likely used to harvest user credentials. Defenders should add spark-updates.live to URL filtering and DNS blocklists, monitor outbound connections to the associated IP, and enforce multi‑factor authentication to mitigate potential credential compromise. Continuous monitoring of threat feeds for additional indicators related to this domain is recommended.