eventrump[.]live

Analysis of eventrump.live shows a newly created domain (registration date February 21 2026) hosted behind Cloudflare infrastructure (nameservers cortney.ns.cloudflare.com, chuck.ns.cloudflare.com, IP 104.21.91.228, AS13335). The site returns HTTP 521, and the only observable page title is “405 Not Allowed”. SSL is issued by Google Trust Services under the WE1 certificate. Threat‑intel feeds indicate the domain appears in one AlienVault OTX pulse and is listed on a single security blocklist; PhishDestroy has already blocked it. VirusTotal scans report 13 of 93 security vendors flagging the domain, and Gridinsoft assigns a trust score of 0 / 100, reinforcing the high‑risk assessment. The combination of recent creation, Cloudflare front‑end, negative reputation scores, and inclusion in active blocklists suggests the domain is being used for a generic phishing campaign. Current evidence does not reveal the specific target brand or payload, so the exact phishing vector remains uncertain. Defenders should add eventrump.live to URL filtering and DNS block rules, monitor for any associated IP or Cloudflare sub‑domains, and update internal threat‑intel feeds to reflect its high‑risk status. Continuous re‑scanning is advised to capture any evolution in the payload or hosting configuration.