events-apyx[.]xyz

This domain, events-apyx.xyz, is currently flagged as a high-risk phishing infrastructure. Registered on March 24, 2026, through Dynadot LLC, the domain resolves to IP address 172.67.135.72, which is hosted on Cloudflare’s network in Canada. Analysis indicates the site uses Cloudflare nameservers liberty.ns.cloudflare.com and syeef.ns.cloudflare.com, a common pattern observed in phishing campaigns leveraging Cloudflare’s proxy services to obscure backend hosting details. The domain’s SSL certificate, issued by Let’s Encrypt, remains valid, which may lend a false sense of legitimacy to potential victims. The site’s HTTP response consistently returns a 403 status code with the page title 'Just a moment...', a behavior often associated with Cloudflare’s interstitial pages or automated bot challenges. Despite this, the domain appears on three security blocklists, including entries from PhishDestroy, MetaMask, and SEAL. Additionally, it has been documented in one threat intelligence pulse on AlienVault OTX, further corroborating its malicious classification. Four out of ninety-five security vendors on VirusTotal have flagged the domain as malicious, though the absence of broader detection does not diminish its confirmed presence on curated blocklists. Infrastructure analysis reveals that the domain is part of a generic phishing operation, though the specific brand or service being impersonated remains unclear. The use of Cloudflare’s infrastructure complicates attribution, as the true origin of the phishing content is masked. Defenders should treat this domain as active and high-risk, particularly given its continued presence on multiple blocklists and its registration recency. Network-level blocking of the domain and its associated IP address, 172.67.135.72, is recommended to mitigate potential exposure. Monitoring for related domains registered through the same registrar or resolving to similar Cloudflare IPs may help identify additional threats in this campaign.