evo-mailer[.]com

Analysis of evo-mailer.com shows that the domain was registered on July 21 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and points to the IPv4 address 212.113.116.112. The domain is currently listed on one security blocklist and has been explicitly blocked by the PhishDestroy mitigation service, indicating that at least one vendor has observed malicious use. The domain resolves to the same IP address used by the nameservers ns3.my-ndns.com and ns4.my-ndns.com, which are typical DNS services and do not themselves provide evidence of benign activity.

No public SSL/TLS certificate information, HTTP response codes, or page‑title data are available, so the surface‑web characteristics of the site remain unverified. The limited visibility suggests that the infrastructure is newly deployed, consistent with the recent registration date, and that the threat actor may be leveraging the domain for a generic phishing campaign aimed at credential harvesting or similar fraud. Because the domain is marked as active and appears on a blocklist, defenders should treat any traffic to or from evo-mailer.com as suspicious.

Recommended actions include adding the domain and its resolved IP address to outbound filtering rules, monitoring DNS queries for the associated nameservers, and employing network‑level alerts for connections to 212.113.116.112. Organizations using threat‑intelligence feeds should ensure that the PhishDestroy blocklist entry is incorporated into their security controls. Continuous re‑evaluation is advised, as additional indicators such as malware scans, SSL certificates, or page content may emerge.