eventchecker-qn[.]netlify[.]app

The domain eventchecker-qn.netlify.app is currently listed as active and under investigation for a generic phishing campaign. Open source intelligence indicates that the domain is present on three independent security blocklists and is actively blocked by the PhishDestroy, MetaMask, and SEAL filtering services. A VirusTotal analysis performed on the domain shows that 91 security vendors have examined the host, and none reported a detection at the time of the scan; this absence of detections should not be interpreted as evidence of benign intent, but rather reflects the limitations of current signature‑based tools.

The limited public data does not reveal the underlying hosting infrastructure, registrar, IP address, SSL configuration, or HTTP response details, leaving the full scope of the malicious infrastructure uncertain. Defenders should treat the domain as potentially malicious, enforce blocklist policies that include the three known blocklists, and consider adding the domain to internal deny lists. Network monitoring should flag any outbound connections to the host, and endpoint security solutions should be configured to alert on attempts to resolve or contact the domain.

Because the threat is classified as generic phishing, any credential‑harvesting activity would likely target credential fields; therefore, organizations should educate users about unsolicited requests for personal information and encourage verification of any communication that references the domain. Continuous re‑evaluation is recommended, as additional intelligence such as host‑level indicators or content analysis may emerge.