evm-vg[.]netlify[.]app

Analysis as of August 07, 2026 indicates that the domain evm-vg.netlify.app is actively associated with a generic phishing threat. The site is hosted on Netlify, as reflected in the registrar information, and resolves to the IP address 35.157.26.135, which is part of the infrastructure used by Netlify's front‑end delivery network. The domain has been added to one security blocklist and is listed by the PhishDestroy blocking service, confirming that external threat‑monitoring platforms have observed malicious activity tied to this hostname. A recent VirusTotal scan queried the domain against 91 antivirus and URL‑reputation engines; none of the engines returned a detection at the time of the scan.

While the absence of detections may suggest that automated signatures have not yet identified the payload, it does not constitute evidence of safety, and the domain remains classified as malicious based on its blocklist status and phishing designation. Publicly available metadata does not include details such as SSL certificate parameters, HTTP response codes, or page title content, so the precise visual or functional characteristics of the landing page remain unknown. Consequently, defenders cannot verify whether credential‑harvesting forms or other deceptive elements are present without direct inspection.

Given the current evidence, security teams should treat evm-vg.netlify.app as a hostile resource. Recommended actions include adding the hostname to inbound and outbound URL filtering rules, monitoring DNS queries for resolution to 35.157.26.135, and correlating any user‑initiated traffic to the domain with authentication anomalies. Continuous re‑evaluation is advised, as further intelligence may reveal additional infrastructure components or detection signatures.