event-nerve[.]xyz

This domain, event-nerve.xyz, is under active investigation for credential harvesting phishing activity following multiple security detections. Registered on March 26, 2026, through a privacy-protected registrar, the domain currently resolves to 104.21.95.54, an address geolocated to a content delivery network provider in Canada. Infrastructure analysis reveals the use of Cloudflare nameservers, which is consistent with tactics used to obscure hosting origins and evade takedowns. The domain is actively blocked by at least one security vendor and appears on a single public threat intelligence blocklist, with five out of ninety-five security engines flagging it as malicious in aggregated scanning results. The SSL certificate issued by a widely used public certificate authority indicates encrypted communication, a common feature in modern phishing campaigns to mimic legitimate services. Despite the encryption, the domain returns an HTTP 403 status, suggesting either restricted access, a staging environment, or an attempt to evade automated detection tools. Its inclusion in a threat intelligence pulse further supports the classification as a high-risk asset, though the specific target or impersonated brand remains unconfirmed in available data. Defenders should treat this domain as an active threat. The combination of recent registration, Cloudflare proxying, and security vendor detections provides sufficient evidence for immediate blocking at the network perimeter. Monitoring for related subdomains or newly associated IP addresses is recommended, as the infrastructure may be repurposed for additional phishing operations. Given the domain's persistence and evasion tactics, security teams should prioritize log correlation to identify any successful connections from internal endpoints.