events-compoundlabs[.]xyz

This domain, events-compoundlabs.xyz, was registered on April 14, 2026 through Dynadot LLC and is currently active. The site presents a page title of “Just a moment…”, returns HTTP 403, and serves a Let’s Encrypt certificate (E8). DNS resolution points to 104.21.9.129, hosted by Cloudflare, Inc. in Canada, and uses the authoritative name servers evan.ns.cloudflare.com and ligia.ns.cloudflare.com. The infrastructure profile shows a Gridinsoft trust score of 0 out of 100 and the domain appears on a single security blocklist. It has been flagged in one AlienVault OTX pulse and is listed as blocked by PhishDestroy. VirusTotal analysis records two positive detections out of ninety‑five scanners, indicating that a minority of vendors have identified malicious behavior. Analysis of the observable attributes aligns with a brand‑impersonation campaign targeting the Compound brand. The use of a generic page title, combined with a 403 response, suggests an attempt to hide malicious payloads behind a Cloudflare‑protected front end. No additional content or download vectors were captured, leaving the exact phishing technique uncertain, but the low trust score and blocklist presence imply high risk. Defenders should immediately block DNS resolution to events-compoundlabs.xyz and add the IP address 104.21.9.129 to network deny lists. Continuous monitoring of Cloudflare‑served IP ranges for similar patterns is advised, as well as periodic re‑scanning with updated VirusTotal engines. Organizations using the Compound brand should educate users about the spoofed domain and enforce URL verification controls.