tsrqpwww[.]kjihgfedsummer-conference-2026[.]mario-s-event-organization[.]fullsailevents[.]com

The domain tsrqpwww.kjihgfedsummer-conference-2026.mario-s-event-organization.fullsailevents.com has been identified as a generic phishing threat specializing in brand impersonation. Analysis indicates the site mimics Full Sail Events, a legitimate event management platform, to deceive conference and workshop attendees into disclosing credentials or financial information. The domain is currently offline, though prior activity suggests it was operational during a targeted campaign. Infrastructure analysis reveals the domain was registered on February 21, 2026, through GoDaddy.com, LLC, a registrar frequently exploited for malicious operations. It resolved to the IP address 143.198.30.146, a host with a history of association with phishing infrastructure. Detection metrics show the domain was flagged by 2 of 95 security vendors on VirusTotal, while independent trust scoring systems assigned it a Gridinsoft trust score of 0 out of 100. The domain appears on three security blocklists and has been actively blocked by browser-based security tools, including MetaMask and SEAL. Technologies detected on the site include Stripe payment integration, HSTS headers, and HTTP/3 protocol support, which may have been employed to lend an appearance of legitimacy to the fraudulent platform. Current status confirms the domain has been taken offline, likely in response to detection and mitigation efforts. However, the infrastructure and registration patterns suggest the threat actor may re-emerge under a similar naming convention or through newly registered domains. Organizations and individuals are advised to monitor for domains incorporating event-related keywords, particularly those impersonating known event management brands. Network defenders should update blocklists to include the IP address 143.198.30.146 and any associated domains registered through the same registrar during the same timeframe. End users should verify event-related communications through official channels and avoid entering credentials or payment details on unsolicited platforms, even if they appear visually consistent with legitimate services.