vupdate[.]nmlkjihgfedsummer-conference-2026[.]mario-s-event-organization[.]fullsailevents[.]com

Analysis of the domain vupdate.nmlkjihgfedsummer-conference-2026.mario-s-event-organization.fullsailevents.com indicates an elevated-risk credential phishing infrastructure targeting event management platforms. The domain, registered on February 21, 2026, through GoDaddy.com, LLC, resolves to the IP address 143.198.30.146, hosted on DigitalOcean, LLC (AS14061) in the United States. No SSL certificate is present, increasing susceptibility to interception or manipulation of transmitted data. The domain's page title, 'Full Sail Events - Complete Event Management Platform for Conferences & Workshops,' suggests an attempt to impersonate a legitimate event management service. However, no direct evidence confirms the exact content or functionality of the phishing page itself.

Infrastructure analysis reveals the use of Cloudflare nameservers (leia.ns.cloudflare.com and quentin.ns.cloudflare.com), which may obscure the true hosting origin and complicate takedown efforts. Detected technologies include Stripe, HSTS, and HTTP/3, which could be leveraged to enhance the appearance of legitimacy or facilitate data exfiltration. As of July 25, 2026, the domain has been taken offline, though its prior activity remains a concern. It appears on one security blocklist and was flagged by PhishDestroy.

Gridinsoft assigns a trust score of 0/100, indicating high suspicion. While VirusTotal records show a single detection from 95 security vendors, this limited visibility does not rule out malicious intent. Defenders should treat this domain as compromised and monitor for related infrastructure, particularly subdomains or IPs associated with DigitalOcean or Cloudflare. Organizations using event management platforms are advised to verify any communications originating from similar domains and implement multi-factor authentication to mitigate credential theft risks.