evmsecureconnect[.]com

Analysis of evmsecureconnect.com shows a high‑risk credential‑phishing infrastructure that remains active as of 12 July 2026. The domain was registered on 10 August 2025 through Porkbun LLC and resolves to the IP address 75.2.60.5, which belongs to AS16509 Amazon.com, Inc. in the United States. MX records point to fwd1.porkbun.com (priority 10) and fwd2.porkbun.com (priority 20). The site is hosted on Netlify, serves HTTPS with a Let’s Encrypt/E7 certificate, and enforces HSTS. HTTP requests return status 200. Reputation services assign a Gridinsoft score of 0/100 and a Scamadviser score of 30/100. The domain is listed on four security blocklists and is already blocked by multiple threat‑intel feeds, including PhishDestroy, Polkadnet, Enkrypt, and Codeesura. VirusTotal reports 15 of 95 scanners flagging the domain. While the exact page content has not been examined, the combined evidence confirms credential‑phishing activity. Defenders should block the domain and its resolving IP at DNS and firewall layers, monitor for related traffic, and consider adding the host to internal blocklists. Continuous re‑evaluation is advised, as the infrastructure may evolve.