events-grove[.]xyz

Analysis indicates that the domain events-grove.xyz was registered on 13 March 2026 through Dynadot LLC and is hosted behind Cloudflare (AS13335). DNS resolution points to 104.21.90.67, and the authoritative nameservers are eleanor.ns.cloudflare.com and jakub.ns.cloudflare.com. The site presents an HTTPS certificate issued by Let’s Encrypt (E7) and responds with HTTP 403, while the page title returned by the server is “events-grove.xyz | 504: Gateway time-out”. VirusTotal records show a single vendor detection, and Gridinsoft assigns a trust score of 0/100. The domain is listed on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, confirming its classification as a high‑risk generic phishing infrastructure. Current activity status remains active as of 12 July 2026. While the exact phishing lure and target audience have not been observed, the infrastructure characteristics—new registration, Cloudflare front‑end, low trust score, and multiple blocklist entries—are consistent with automated phishing campaigns. Defenders should add the IP address 104.21.90.67 to network deny lists, enforce DNS filtering for the domain, and monitor for any related sub‑domains or CNAME records. Continuous re‑scanning of the domain on multi‑engine services is advised to capture potential payload changes.