sparkwex[.]com

Analysis of sparkwex.com, observed on July 24, 2026, indicates a brand‑impersonation campaign targeting the foundation brand. The site presented the page title “SPARKWEX | Play at the best online casino based on Blockchain”, which aligns with a Gambler Scam kit and a crypto‑scam payload. The domain was registered on August 09, 2025 through Key‑Systems GmbH and uses Cloudflare nameservers (drew.ns.cloudflare.com, sharon.ns.cloudflare.com). DNS resolution points to IP 172.67.214.68, owned by AS13335 Cloudflare, Inc., located in the United States. No TLS certificate was observed, and the service is currently taken offline.

Reputation signals are extremely low: Gridinsoft assigns a trust score of 1 / 100, and the domain appears on a single security blocklist. VirusTotal analysis shows three of ninety‑five AV engines flagging the host, reinforcing the malicious classification. PhishDestroy has already blocked the domain. The evidence suggests a typical crypto‑scam infrastructure that leverates Cloudflare’s CDN to obscure origin and to benefit from the platform’s free SSL termination, despite the lack of an active certificate in this snapshot.

Defenders should immediately add sparkwex.com to URL filtering and sink‑hole rules, block the associated IP address, and monitor any new subdomains under the same registrar or Cloudflare account. Because the underlying IP belongs to a shared hosting provider, further traffic from the same /24 should be scrutinized for similar Gambler Scam patterns. Continuous enrichment of threat intel feeds with the observed kit and the “foundation” brand tag will improve detection of future clones. Until the domain reappears, any attempt to resurrect the site should be treated as high‑risk, and incident response teams should be prepared to handle potential crypto‑related credential harvesting attempts.