events-compound[.]xyz

The domain events-compound.xyz was identified as a brand impersonation threat targeting Compound Finance, a decentralized lending protocol. This phishing site attempted to deceive users into believing it was affiliated with Compound, likely to steal login credentials or cryptocurrency assets. No specific drainer kit was identified, but the site's structure and behavior were consistent with credential harvesting and wallet-draining attacks.

The technical analysis reveals several red flags. VirusTotal flagged the domain with 5 out of 95 security vendors detecting malicious activity. The domain was registered through Dynadot LLC on April 14, 2026, a relatively recent creation date that often indicates a phishing setup. It resolves to IP address 104.21.42.143 and uses a Let's Encrypt SSL certificate (E7), which is common among phishing sites due to its free and automated issuance. The domain appears on three security blocklists and was found in one threat intelligence pulse on AlienVault OTX. Google Safe Browsing status was not explicitly provided, but the elevated risk level suggests it would likely be blocked.

As of the latest check, events-compound.xyz is offline, indicating that hosting providers or security teams have taken action to mitigate the threat. However, users should remain cautious as similar domains may reappear. PhishDestroy recommends that users always verify the legitimacy of any site claiming to be Compound Finance by visiting the official website directly. Avoid clicking on links from unsolicited messages or search results. If you have already interacted with this domain, monitor your accounts for unauthorized activity and consider revoking any permissions granted to suspicious smart contracts.