eventchecker-tx[.]netlify[.]app

The domain eventchecker-tx.netlify.app is hosted on Netlify, a cloud‑based static‑site service that typically fronts content through Amazon Web Services. DNS resolution points to the IP address 35.157.26.135, an AWS endpoint that is shared by many legitimate and malicious sites. The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy, indicating that at least one independent threat‑intel source has classified the host as malicious. A VirusTotal scan was performed by 91 antivirus engines; none reported a detection, but the lack of a positive finding does not constitute evidence of benign intent and should not be interpreted as a safety guarantee.

The registrar information shows Netlify as the registering entity, but no WHOIS details, creation date, or expiration data are provided in the current dataset. Nameserver queries returned NS_NOT_FOUND, suggesting either reliance on Netlify’s internal DNS handling or a misconfiguration that prevents standard NS lookup. No SSL certificate data, HTTPS status, or page‑title metadata are available, so the presence of encryption, the exact content served, and any brand being spoofed remain unknown.

Given the limited visible indicators, defenders should treat the domain as high‑risk until further analysis clarifies its purpose. Recommended mitigations include adding the domain to DNS‑based blocklists, deploying a sinkhole for any attempted resolution, monitoring outbound traffic for connections to the underlying AWS IP, and initiating a manual content fetch in a controlled environment to capture page titles or potential credential‑capture forms. Continuous observation and correlation with endpoint logs are advised to detect any exploitation attempts that may leverage this infrastructure.