event[.]mon-l1[.]com

This report details a malicious domain, event.mon-l1.com, which is an inactive impersonation site targeting the Twitter brand. The site displayed the page title "Invite Code Not Found", indicating it was likely part of a credential harvesting or account takeover campaign where users were tricked into entering invite codes or login credentials under the pretense of accessing a Twitter-related service. The threat posed is phishing and identity theft, as the site impersonated a well-known platform to collect sensitive user information.

Technical analysis shows the domain was flagged by 11 out of 95 VirusTotal vendors. It is registered through Tucows Domains Inc. and was created on 2025-10-16. The site resolves to IP address 2a06:98c1:3121::3, hosted in the US by AS13335 Cloudflare, Inc. The domain lacks an SSL certificate, which is unusual for a legitimate service. It uses nameservers kyrie.ns.cloudflare.com and may.ns.cloudflare.com. The domain was flagged by blocklists including ChainPatrol, alphaMountain.ai, BitDefender, Certego, and CRDF.

The domain is currently DOWN/OFFLINE, indicating it has been neutralized or abandoned. Risk assessment tools rate it as extremely dangerous, with GridinSoft trust at 0/100, ScamAdviser trust at 1/100, and a DOM risk score of 10. The combination of high detection rates, lack of SSL, and low trust scores confirms this domain posed a high risk for phishing attacks.