event-chooserich[.]fun

This domain, event-chooserich.fun, is identified as a credential theft operation targeting users of event ticketing platforms. Analysis indicates the site mimics legitimate ticket vendors to harvest login credentials, payment details, or personal information under false pretenses. No direct association with known crypto drainer kits has been confirmed, but the domain exhibits characteristics consistent with large-scale credential harvesting campaigns, including deceptive subdomains and urgency-driven lures. Infrastructure analysis reveals the domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on May 24, 2026, and resolved to IP address 188.114.97.3. At the time of assessment, VirusTotal reported 11 out of 95 security vendors flagging the domain as malicious. The domain appears on three independent security blocklists and is actively blocked by at least three endpoint protection mechanisms. Google Safe Browsing (GSB) status was not explicitly provided, but the domain’s presence on multiple blocklists suggests it was likely flagged by major browser-based security layers. The domain is currently offline, reducing immediate exposure risk. However, the registration remains active, and the infrastructure could be repurposed for future malicious campaigns. Organizations and users are advised to monitor for re-registration under similar naming conventions (e.g., event-chooserich.xyz) and implement DNS-based blocking for the resolved IP and associated registrar patterns. Network defenders should treat domains registered through this registrar with heightened scrutiny, particularly those created in bulk with deceptive prefixes or suffixes.