events-zerion[.]xyz

Analysis of the domain events-zerion.xyz confirms it is an active phishing site impersonating Zerion, a known cryptocurrency platform. The domain was registered on April 14, 2026, through Dynadot LLC and currently resolves to the IP address 104.21.15.195, hosted on Cloudflare infrastructure in Canada. Nameservers asa.ns.cloudflare.com and ridge.ns.cloudflare.com further indicate Cloudflare as the underlying provider. The site presents an HTTP 403 status with the page title 'Just a moment...', a common Cloudflare interstitial response, which may obscure the actual phishing content from automated scanners or casual inspection. Infrastructure analysis reveals the use of a Let's Encrypt SSL certificate (identifier E8), providing HTTPS encryption to lend legitimacy to the fraudulent site. The domain is flagged by multiple security vendors and blocklists, including PhishDestroy, MetaMask, and SEAL, and appears in at least one AlienVault OTX threat intelligence pulse. Gridinsoft assigns a trust score of 0/100, reflecting high confidence in its malicious nature. While eight of 94 security vendors on VirusTotal detect the domain as malicious, the absence of detections from other vendors does not imply safety, as coverage varies across engines. The exact phishing mechanism or payload remains unconfirmed due to the 403 response, but the domain's naming convention and known intelligence align with brand-impersonation tactics targeting Zerion users. Defenders should treat this domain as high-risk and implement immediate blocking at the DNS, network, or endpoint level. Given its active status and association with Cloudflare, takedown efforts may require coordination with the hosting provider and registrar. Further analysis of the site's content, once accessible, would clarify the specific scam vector employed.