antihunterevent[.]org

The domain antihunterevent.org was registered on 27 February 2026 via PDR Ltd. d/b/a PublicDomainRegistry.com and uses the Cloudflare nameservers haley.ns.cloudflare.com and keenan.ns.cloudflare.com. DNS resolution points to 188.114.96.3, an address owned by AS13335 Cloudflare, Inc. and geolocated to the United States. No TLS certificate was observed, indicating the site was served over plain HTTP at the time it was captured. The only visible page element was the title string "x.com/", which suggests the page may have been attempting to reference the X.com brand, although no further content has been analyzed. The domain appears on three external security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL.

VirusTotal analysis shows that two of ninety‑three anti‑malware engines flagged the domain, confirming that at least a minority of scanners consider it malicious. The current operational status is offline, and the site is no longer reachable. Evidence indicates that the infrastructure leverages Cloudflare’s edge network, a common choice for phishing operators seeking fast global delivery and built‑in mitigation against takedown requests. The lack of a TLS certificate, combined with the short domain age of less than five months, aligns with typical fast‑flux or opportunistic phishing campaigns. However, the exact phishing kit, credential‑stealing method, or target audience cannot be determined from the available data, and no additional payload or redirect information is known.

Defenders should add antihunterevent.org to internal blocklists and ensure that any outbound request to the IP 188.114.96.3 is logged and monitored. Network traffic that includes HTTP requests without TLS to this host should be treated as suspicious. Because the domain has already been listed on multiple blocklists, threat‑intel feeds that incorporate those sources will likely provide early warning for future re‑use of the same hosting assets.