event-nomina[.]xyz

This domain, event-nomina.xyz, is actively flagged as a high-risk phishing endpoint with a current HTTP 504 Gateway Time-out response. Registered on March 13, 2026, through Dynadot LLC, the domain resolves to IP address 104.21.56.133, which is protected by Cloudflare infrastructure. Analysis indicates the use of HTTP/3 and a Let's Encrypt SSL certificate, common in both legitimate and malicious deployments. The domain appears on two security blocklists and has been included in 23 threat intelligence pulses on a major open-source threat exchange platform, suggesting recurring malicious activity. Security vendors have detected this domain with moderate consistency, as 13 out of 95 engines on a widely used malware scanning service flagged it as malicious. The domain remains active despite the 504 error, which may indicate temporary hosting issues or deliberate evasion tactics. The registration details and infrastructure choices align with patterns observed in phishing campaigns targeting financial or payroll-related lures, though the exact payload or deception method remains unconfirmed due to the current gateway timeout. Defenders should treat this domain as hostile and prioritize blocking it at the network level. The IP address 104.21.56.133 should be monitored for additional malicious domains, as Cloudflare-protected IPs are frequently reused in phishing operations. Given the domain's presence on multiple blocklists and its inclusion in numerous threat intelligence reports, organizations should review logs for any prior connections to event-nomina.xyz or its associated IP. If internal systems or users have interacted with this domain, immediate investigation for credential theft or malware delivery is recommended.