evolabs[.]agency

Analysis as of July 22 2026 indicates that evolabs.agency is an active domain employed to impersonate Facebook for social media phishing. The site was registered on January 11 2025 through GoDaddy.com, LLC and resolves to the Google Cloud address 34.111.179.208, ASN 396982, located in the United States. DNS resolution uses the registrar‑provided nameservers ns59.domaincontrol.com and ns60.domaincontrol.com. The TLS certificate is issued by Let’s Encrypt (E7) and the server returns HTTP 200 with HSTS enabled, confirming a properly configured HTTPS endpoint. The page title disclosed by the crawler reads “EvoLabs Agency – Double Your Trades Jobs Without Marketing | AI‑Powered Marketing for Trades Professionals,” which does not reference Facebook but the domain is listed as impersonating that brand in the intelligence feed.

Infrastructure analysis reveals a Node.js application hosted on Google Cloud, employing Express, Google Cloud Trace, Google Cloud CDN, and HTTP/3. Calendly integration indicates scheduling functionality, a common element in phishing kits. The Gridinsoft trust score of 0 / 100 further corroborates a malicious reputation. Two independent blocklists—PhishDestroy and ScamSniffer—have already listed the domain, and two of ninety‑five VirusTotal scanners flagged it as malicious. No additional detection sources such as Safe Browsing or OTX are cited in the available data.

While the exact phishing page content has not been captured, the combination of brand impersonation labeling, social media phishing classification, and the presence of a legitimate‑looking marketing page title suggests a credential‑harvesting campaign targeting Facebook users. Defenders should block DNS resolution to 34.111.179.208, enforce URL filtering for the full domain name, and monitor outbound traffic for connections to Google Cloud services originating from internal clients.