events-whatsyourlore[.]fun

Analysis of events-whatsyourlore.fun indicates that the domain was registered on February 21, 2026 and has since been taken offline. The site was observed to host a crypto‑draining scam that masquerades as the backpack brand, as reflected in the declared brand target and the page title "lore-verse-unleashed." Infrastructure details show the domain resolves to 172.67.154.109, a Cloudflare address (AS13335) located in the United States. The SSL certificate presented is identified as WE1, and the authoritative name servers are bristol.ns.cloudflare.com and hasslo.ns.cloudflare.com. Registration was performed through PDR Ltd. d/b/a PublicDomainRegistry.com, a known registrar for disposable domains.

The domain appears on two security blocklists and has been actively blocked by PhishDestroy and ScamSniffer. Reputation scoring from Gridinsoft assigns a zero out of one hundred, indicating an extremely low trust level. VirusTotal reports four positive detections out of ninety‑three participating security vendors, confirming malicious activity.

While the site is currently offline, the combination of brand impersonation, crypto‑scam classification, low trust score, blocklist presence, and multiple vendor detections provides strong evidence of malicious intent. Defenders should continue to block the domain at perimeter controls, monitor the associated IP address for any resurgence, and add the domain to internal threat‑intel feeds. Further investigation of any residual DNS records or cached content is recommended to capture additional artifacts that may aid in attribution or future mitigation efforts.