index[.]5a-evmcheck[.]lol

Analysis conducted on August 03, 2026 identifies index.5a-evmcheck.lol as an active phishing infrastructure that is currently under investigation. The domain has been definitively blocked by the PhishDestroy mitigation service, and it appears on a single public security blocklist, indicating that at least one external threat intelligence source has classified the host as malicious. VirusTotal records show that the domain was submitted for scanning and examined by 91 independent antivirus and sandbox vendors; none of those engines generated a detection at the time of the scan.

The report explicitly notes that the lack of detections does not constitute proof of safety, and the domain remains listed as suspicious by the blocking services. No additional metadata such as registrar, ASN, hosting IP, SSL certificate details, HTTP response codes, or Safe Browsing verdicts were available in the supplied intelligence, so infrastructure‑level attributes cannot be corroborated at this stage. Consequently, the confidence in the phishing classification rests primarily on the PhishDestroy block and the presence on a recognized blocklist.

Defenders are advised to continue to enforce URL filtering rules that deny access to index.5a-evmcheck.lol, to propagate the blocklist entry across internal threat feeds, and to monitor any future VirusTotal or sandbox submissions for changes in detection status. Ongoing surveillance of DNS resolution patterns and host activity is recommended to capture any pivoting behavior or additional payload delivery mechanisms that may emerge as the campaign evolves.