spark[.]fi-v3-app-connect-wallet[.]com

Analysis indicates that spark.fi-v3-app-connect-wallet.com was registered on February 21, 2026 and is presently offline. The domain resolves to IP address 172.67.181.221, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The site presents a page titled “Access Denied,” suggesting that the content has been removed or blocked. Security telemetry shows that the domain is listed on a single blocklist and has been specifically flagged by PhishDestroy.

VirusTotal scans reported nine detections out of ninety‑three participating security vendors, reinforcing the malicious classification. Additional reputation signals include a Gridinsoft trust score of 0 out of 100 and an SSL certificate labeled “WE1,” which provides no indication of legitimate ownership. The overall threat type is identified as a crypto drainer, a category of scam that attempts to illicitly transfer cryptocurrency assets from victims.

While the domain is no longer reachable, its recent creation date, association with a Cloudflare‑hosted IP, low trust score, and multiple vendor detections suggest it was actively used for malicious cryptocurrency‑related activity before being taken offline. Defenders should continue to block the domain and its resolving IP at perimeter and endpoint layers, monitor for any resurgence of the domain or similar sub‑domains, and correlate any internal alerts that reference the IP 172.67.181.221 or the SSL certificate identifier. Ongoing threat‑intel feeds should be queried for emerging indicators that may reuse the same hosting infrastructure, and any compromised credentials linked to the domain should be revoked.