event-centrifugeio[.]com

On 29 July 2026 analysts observed the domain event-centrifugeio.com being used in a generic phishing campaign. The domain was registered on 11 June 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with rapid bulk registrations. Since its creation the domain has been added to three independent security blocklists and is actively blocked by the PhishDestroy, MetaMask, and SEAL filtering services.

A VirusTotal query shows the host was examined by 91 AV engines, none of which returned a detection at the time of analysis; the absence of detections does not imply benign intent. No public information on the hosting provider, IP address, TLS certificate, or HTTP response codes is presently available, and the page title has not been disclosed in the current intelligence set. The limited artefacts suggest the infrastructure is in an early operational phase, relying on rapid domain turnover and reliance on blocklist and wallet‑level defenses to impede victims.

Defenders should add event-centrifugeio.com to local deny lists, monitor DNS queries for this FQDN, and enforce multi‑factor authentication on accounts that could be targeted. Continuous re‑scanning on VirusTotal and inclusion in threat‑intel feeds is recommended to capture any subsequent payloads or indicator changes. Analysts should also trace any resolved IP addresses once they become observable to assess hosting geography and potential affiliation with known malicious ASNs.