zyxwvutsrqponmponmlkjihgfadcbaupdate[.]yxwvutsnmlkjihgfedsummer-conference-2026[.]mario-s-event-organization[.]fullsailevents[.]com

This domain, mario-s-event-organization.fullsailevents.com, operates as credential theft infrastructure targeting users of event management platforms. Analysis indicates the subdomain impersonates legitimate conference and workshop services, presenting a fraudulent login interface under the guise of a professional event organization tool. The page title, 'Full Sail Events - Complete Event Management Platform for Conferences & Workshops,' aligns with common credential harvesting tactics, where attackers mimic trusted brands to deceive victims into submitting sensitive account details. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on February 21, 2026, through GoDaddy.com, LLC, and resolves to the IP address 143.198.30.146. Security vendors have flagged this domain, with 2 out of 95 engines on VirusTotal detecting malicious activity. Additionally, the domain appears on three independent security blocklists, including MetaMask and SEAL, further corroborating its association with credential theft operations. Detected technologies include Stripe integration and HTTP/3, suggesting an attempt to mimic legitimate payment and security features. Users who visited this domain or entered credentials should take immediate remedial action. All submitted login details should be considered compromised and must be changed across any platforms where identical credentials were reused. System scans using updated security tools are recommended to detect potential secondary infections. Organizations should monitor network traffic for connections to 143.198.30.146 and review logs for interactions with the domain. If financial transactions were attempted, affected parties should contact their payment providers to dispute unauthorized charges and enable additional fraud monitoring.