rqponqpkjihgfedsummer-conference-2026[.]mario-s-event-organization[.]fullsailevents[.]com

This domain, rqponqpkjihgfedsummer-conference-2026.mario-s-event-organization.fullsailevents.com, is flagged as a generic phishing threat designed to impersonate Full Sail Events, a legitimate event management platform for conferences and workshops. Analysis indicates the domain mimics authentic branding through its page title, 'Full Sail Events - Complete Event Management Platform for Conferences & Workshop,' suggesting an intent to deceive users into believing they are interacting with a trusted service. No specific drainer kit or crypto-related functionality was identified, but the presence of Stripe integration implies potential credential harvesting or financial fraud vectors. The domain exhibits characteristics of a broad-scale phishing campaign targeting event attendees or organizers. Technical indicators reveal the domain was registered on February 21, 2026, through GoDaddy.com, LLC, and resolves to the IP address 143.198.30.146. VirusTotal detection shows 5 out of 95 security vendors flagging the domain as malicious, while it appears on four security blocklists, including MetaMask, SEAL, PhishDestroy, and OISD. The domain employs HSTS and HTTP/3, which may be leveraged to enhance perceived legitimacy or evade detection. Gridinsoft assigns a trust score of 0/100, reinforcing its classification as high-risk infrastructure. No entries were found in Google Safe Browsing at the time of analysis. The domain is currently offline, likely due to takedown actions or infrastructure suspension. Despite its inactive status, residual risk remains for users who may have interacted with the domain prior to its removal. Organizations should monitor for credential reuse or unauthorized access attempts stemming from this campaign. Users are advised to verify domain authenticity through official channels, avoid clicking on unsolicited links, and implement multi-factor authentication to mitigate potential account compromise. Network-level blocking of the IP 143.198.30.146 and associated subdomains is recommended for proactive defense.