knmlkjihcbedcbupdate[.]zyxwvuponmlkjihgfedsummer-conference-2026[.]mario-s-event-organization[.]fullsailevents[.]com

This domain, knmlkjihcbedcbupdate.zyxwvuponmlkjihgfedsummer-conference-2026.mario-s-event-organization.fullsailevents.com, is identified as a credential phishing threat targeting users through brand impersonation. Analysis indicates the domain mimics Full Sail Events, a legitimate event management platform, by replicating its page title (Full Sail Events - Complete Event Management Platform for Conferences & Workshops) and leveraging a subdomain structure designed to appear authoritative. The threat type is credential theft, with no evidence of crypto drainer functionality or payment redirection scripts at the time of analysis. The domain was constructed to exploit trust in event registration portals, likely targeting attendees of future conferences or workshops under the guise of account verification or registration updates. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 143.198.30.146 and was registered on February 21, 2026, through GoDaddy.com, LLC. VirusTotal detection shows 4 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain is blocked by three security blocklists, including MetaMask, SEAL, and PhishDestroy. Technologies detected on the site include Stripe (likely for payment credential harvesting), HSTS (enforcing HTTPS to appear legitimate), and HTTP/3 (modern protocol usage to evade legacy security filters). No Google Safe Browsing (GSB) flags were reported at the time of assessment, though this may reflect a delay in propagation rather than absence of risk. The domain is currently offline, reducing immediate exposure to end users. However, the infrastructure remains registered and could be reactivated or repurposed for future campaigns. Response actions by security providers have effectively neutralized the active threat, but the registration details and hosting configuration suggest potential for re-emergence. Remaining risk includes the possibility of credential reuse by threat actors who may have already harvested data prior to takedown. Organizations and individuals are advised to monitor for unauthorized access attempts, particularly those related to event registration accounts. If credentials were entered on this domain, immediate password resets are recommended for all associated accounts, especially those linked to payment processors or administrative privileges. Network-level blocking of the IP 143.198.30.146 and domain-level filtering of the full subdomain structure are advised for proactive defense.