tsrutsnmlkjihgfedsummer-conference-2026[.]mario-s-event-organization[.]fullsailevents[.]com

This domain, tsrutsnmlkjihgfedsummer-conference-2026.mario-s-event-organization.fullsailevents.com, is flagged as an elevated-risk credential theft phishing operation. Analysis indicates the infrastructure impersonates Full Sail Events, a legitimate event management platform, using a fabricated subdomain structure designed to mimic upcoming conferences or workshops. The threat actor likely targeted attendees of future events by presenting fraudulent registration or login portals to harvest credentials, payment details, or personal data. No crypto drainer kit signatures were detected, and the operation appears focused on traditional credential theft rather than cryptocurrency fraud. Infrastructure analysis reveals the following technical indicators: the domain was registered through GoDaddy.com, LLC on February 21, 2026, and resolves to the IP address 143.198.30.146. At the time of detection, the domain was flagged by 2 out of 95 security vendors on VirusTotal, with no valid SSL certificate present. The domain appears on three independent security blocklists, though it was not listed in Google Safe Browsing at the time of assessment. The absence of HTTPS further reduces trust signals, increasing the likelihood of detection by security tools. The domain has since been taken offline, likely due to hosting provider intervention or registrar suspension. However, residual risk remains for organizations or individuals who may have interacted with the domain prior to its removal. Security teams are advised to monitor for unauthorized access attempts using credentials potentially harvested from this campaign. Network administrators should block the resolved IP address (143.198.30.146) and the full domain at perimeter defenses. End users who entered credentials on this site should rotate passwords immediately and enable multi-factor authentication on associated accounts. Given the impersonation of a legitimate event platform, additional phishing domains using similar naming conventions may emerge, warranting heightened vigilance for lookalike domains.