qtsrqpkjihgfedsummer-conference-2026[.]mario-s-event-organization[.]fullsailevents[.]com

This domain, qtsrqpkjihgfedsummer-conference-2026.mario-s-event-organization.fullsailevents.com, was registered on February 21, 2026 through GoDaddy.com, LLC and resolved to the IP address 143.198.30.146, which belongs to DigitalOcean, LLC (AS14061) in the United States. The site was hosted behind Cloudflare name servers (leia.ns.cloudflare.com, quentin.ns.cloudflare.com) and employed HTTP/3 and HSTS, but no SSL certificate was presented, indicating an insecure transport layer. The page title returned by the server was "Full Sail Events - Complete Event Management Platform for Conferences & Workshops," suggesting the domain was masquerading as a legitimate event‑management service. The infrastructure was flagged by three independent blocklists and is currently blocked by PhishDestroy, MetaMask, and SEAL.

VirusTotal analysis recorded detections from two of ninety‑three security vendors, reinforcing the suspicion of malicious use. Gridinsoft assigned a trust score of zero out of one hundred, and the domain is presently taken offline, limiting active exploitation. The presence of Stripe in the technology fingerprint may indicate attempts to harvest payment credentials, though no concrete evidence of credential‑stealing forms has been observed.

Uncertainty remains regarding the exact phishing payload, target audience, and whether any victim data were exfiltrated before takedown. Defenders should continue to block the IP and associated CIDR ranges, monitor for any residual traffic to the domain, and update internal URL filtering rules to include the full domain string. Incident response teams should also review logs for any outbound connections to the IP during the window between registration and takedown, and consider notifying affected users if payment‑related credentials may have been targeted.