eventchecker-qd[.]netlify[.]app

Analysis of eventchecker-qd.netlify.app, observed on July 22, 2026, indicates that the domain is actively used for phishing. The site is listed on three independent security blocklists and is explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering services, confirming that multiple threat‑intelligence providers have identified malicious activity associated with the domain. Registration details show the domain was provisioned through Netlify, a common hosting platform for short‑lived malicious deployments, and the authoritative name server lookup fails (NS_NOT_FOUND), suggesting that the domain may rely on Netlify’s internal DNS handling rather than a traditional external nameserver configuration. Network resolution points to a single IPv4 address, 35.157.26.135, which is owned by the Netlify infrastructure and is frequently reused by other abuse‑related sites, limiting the ability to attribute the hosting to a specific operator.

VirusTotal reports that the domain was scanned by 95 antivirus and URL‑reputation engines; none of the engines raised a detection at the time of scanning. While the lack of detections could reflect a low‑profile payload or evasion, it does not constitute evidence of safety, especially given the corroborating blocklist entries and active blocking by dedicated anti‑phishing services. The current status is listed as active, meaning the domain continues to resolve and can be accessed by end users.

Uncertainty remains regarding the exact content served, any SSL/TLS configuration, and the presence of additional infrastructure such as command‑and‑control hosts, because those attributes have not been publicly disclosed. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists with the observed blocklist identifiers, and monitor the associated IP address for any new malicious resolutions.