events-heisted[.]app

Retained for the record. This text repeats stored detection facts and is not presented as authored analysis.

This domain, events-heisted.app, is flagged as a high-risk credential phishing site. Analysis indicates the page mimics legitimate login portals, likely targeting users with fraudulent authentication prompts under the guise of a service named 'Heisted.' No direct association with known drainer kits or brand impersonation has been confirmed, but the domain's structure and page title suggest intent to harvest credentials through deceptive input forms. Infrastructure analysis reveals the domain was registered on June 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to IP address 104.21.85.167, a Cloudflare-associated endpoint, and uses an SSL certificate issued by Google Trust Services. VirusTotal reports 1/95 security vendor detections, indicating limited but present flagging by security tools. The domain remains unlisted on Google Safe Browsing and maintains a low blocklist presence, suggesting recent or evasive deployment. Current status shows the domain remains active and unresolved by major blocklists. Response actions include monitoring for additional detections, analyzing traffic patterns for victim demographics, and assessing potential ties to broader phishing campaigns. The remaining risk is classified as high due to the domain's operational status, minimal detections, and use of reputable SSL issuers to lend false legitimacy. Users are advised to block the domain at the network level, verify SSL certificates independently, and conduct retrospective log analysis for connections to 104.21.85.167 or events-heisted.app.