pons[.]5a-evmcheck[.]lol

Analysis of the domain pons.5a-evmcheck.lol, observed on August 03, 2026, identifies it as an active generic phishing infrastructure. DNS resolution consistently returns the address 172.67.196.110, indicating that the domain is hosted on a shared cloud service. The domain is currently listed on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, providing an early indicator of malicious intent.

VirusTotal records show that the domain was examined by 91 scanning engines; none of the engines raised a detection at the time of analysis. The absence of detections does not constitute a safety confirmation and should be interpreted as a lack of current signatures rather than proof of benign behavior. No additional data on registrar, SSL certificate details, HTTP response codes, page title, or associated brand targets is available, leaving those aspects unverified.

Given the confirmed presence on a reputable phishing blocklist and the hosting IP’s association with other suspicious activity in prior threat reports, defensive operators should prioritize containment of traffic to this domain. Recommended actions include adding the domain to network‑level deny lists, updating web‑filter rules to block the associated IP, and monitoring for any future emergence of related indicators such as new blocklist entries or vendor detections. Continuous re‑assessment is advised, as the threat landscape may evolve and additional intelligence could surface.