evm-ej[.]netlify[.]app

Analysis of evm-ej.netlify.app as of 2026-08-07 shows that the domain is hosted on Netlify’s free-tier infrastructure. DNS resolution points to the IPv4 address 63.176.8.218, which is associated with Netlify’s content-delivery network. The domain was submitted to VirusTotal and examined by 91 independent scanning engines; none of the engines raised a malicious verdict, but the absence of detections does not constitute a safety guarantee. Independent threat-intel feeds have flagged the domain: PhishDestroy has listed it as malicious, and it appears on a single external blocklist, indicating that at least one security vendor has observed abusive activity linked to the host.

The registration record lists Netlify as the registrar, confirming that the domain was likely created for rapid deployment of short-lived campaigns. No public SSL certificate details, HTTP response codes, or page-title metadata are presently available, limiting visibility into the actual payload delivered to victims. Consequently, the precise nature of the phishing content, target brand, or credential-harvesting mechanism remains unknown.

Defenders should consider adding the domain and its resolved IP address to outbound-traffic deny lists, monitor network logs for connections to 63.176.8.218, and employ URL-filtering solutions that reference the PhishDestroy feed. Continuous re-scanning with multi-engine services is recommended, as the threat posture may evolve if the actors modify the payload or migrate to alternative hosting endpoints. Until further forensic evidence is gathered, the domain should be treated as potentially malicious and handled with appropriate caution.