events-grass[.]xyz

The domain events-grass.xyz was registered on April 24, 2026 through Dynadot LLC and remains active as of July 12, 2026. It is classified as a high‑risk generic phishing operation and is currently serving HTTP 403 responses, indicating restricted access to content.

Infrastructure analysis shows the domain resolves to the IP address 104.21.52.150, which belongs to a network located in Canada operated by a well‑known content delivery provider. The authoritative nameservers are hans.ns.cloudflare.com and nelly.ns.cloudflare.com, confirming the use of the provider's DNS infrastructure. A publicly trusted TLS certificate issued by a recognized authority protects the domain, suggesting an attempt to appear legitimate to victims.

Detection data indicates the domain is listed on two independent security blocklists and is referenced in multiple phishing detection feeds. Three out of ninety‑five security scanners have flagged the domain, and a reputation engine assigns it a trust score of zero out of one hundred. Additionally, a single threat‑intel pulse contains an entry for the domain, reinforcing its malicious reputation.

While the HTTP 403 status limits visibility into the exact payload or social engineering content hosted at the domain, the combination of its high‑risk classification, blocklist presence, low trust score, and recent creation date supports a strong inference of phishing intent. The absence of publicly observable malicious pages leaves the specific campaign details uncertain, but the surrounding evidence aligns with typical phishing infrastructure patterns.

Defenders should treat events-grass.xyz as hostile. Immediate actions include adding the domain to network deny lists, updating DNS filtering rules, and monitoring for any outbound connections to the associated IP address. Continuous observation of threat‑intel feeds for new indicators related to the domain is advised to capture any evolution of the campaign.