events-grvt[.]xyz

Analysis of the domain events-grvt.xyz indicates it is actively associated with generic phishing activity, as classified by multiple security sources. The domain was registered on March 3, 2026, through Dynadot LLC, a registrar frequently observed in phishing campaigns. Infrastructure analysis reveals the domain resolves to the IP address 188.114.96.3, which is part of AS13335 (Cloudflare, Inc.), a network commonly utilized to obscure the origin of malicious traffic. The domain is currently proxied behind Cloudflare nameservers (alexa.ns.cloudflare.com and randall.ns.cloudflare.com), a configuration that further complicates attribution and takedown efforts. Security vendors have flagged events-grvt.xyz on three distinct blocklists, including PhishDestroy, MetaMask, and SEAL, signaling its recognition as a threat across different detection mechanisms. At the time of this report, the domain returns an HTTP 403 status, suggesting access restrictions or a misconfigured server, while the page title displays a 504 Gateway Time-out error. This behavior may indicate an attempt to evade automated scanning or a temporary disruption in the phishing infrastructure. A Let's Encrypt SSL certificate (serial number prefix E8) is present, a common tactic to lend superficial legitimacy to malicious domains. Three out of ninety-four security vendors on VirusTotal have detected this domain as malicious, though the absence of broader detection does not imply safety. The Gridinsoft trust score of 0/100 reinforces its classification as high-risk. Defenders are advised to block traffic to this domain at the network level and monitor for any shifts in its behavior, such as changes in HTTP status codes or the deployment of new content. Given its active status and association with known phishing indicators, continued vigilance is recommended until the domain is fully dismantled or sinkholed.