event-virtualsprotocol[.]xyz

On 25 July 2026, the domain event-virtualsprotocol.xyz was flagged as a generic phishing indicator. The HTTP response included the page title “Virtuals Protocol | Society of AI Agents”. Registration data shows the domain was created on 24 February 2026 through NiceNIC International Group Co., Limited. DNS resolution maps the name to 104.21.85.216, an address owned by Cloudflare, Inc. (AS13335) and located in the United States. No TLS certificate is presented, confirming that the site operated without encryption.

VirusTotal records indicate that 2 of 93 scanned security vendors flagged the domain, and the domain appears on three independent security blocklists. Current infrastructure status is offline, and the domain is explicitly blocked by the PhishDestroy, MetaMask, and SEAL blocklists. Authoritative nameservers are keenan.ns.cloudflare.com and maria.ns.cloudflare.com. The available data confirms that the domain has been used in phishing campaigns targeting users of the “Society of AI Agents” ecosystem, but the exact malicious payload, credential‑capture form, or redirect behavior has not been captured, leaving the functional details uncertain. Because the hosting is behind Cloudflare, deeper server‑side analysis is limited, and the lack of an SSL certificate prevents inspection of encrypted traffic.

The risk level is elevated, indicating a higher likelihood of successful credential theft if the site becomes active. Defenders should immediately add event-virtualsprotocol.xyz to local deny lists and ensure that the three blocklists containing the domain are enforced across perimeter defenses. Monitoring of DNS queries for the IP 104.21.85.216 and of outbound connections from client systems is recommended to detect any residual activity. Where possible, traffic to the domain should be redirected to a sinkhole or blocked at the firewall.