Analysis of evmlotterys.com as of July 30 2026 indicates that the domain was registered on July 26 2026 through Fewmoretaps OU operating as Trustname.com. The authoritative name servers are jasper.ns.cloudflare.com and ziggy.ns.cloudflare.com, placing the domain within Cloudflare's DNS infrastructure. DNS resolution points to IP address 172.67.161.54, a Cloudflare‑owned address associated with shared hosting services. The domain appears on a single security blocklist and is actively blocked by PhishDestroy, confirming that at least one protective feed has identified it as malicious at the time of analysis.
VirusTotal reports that the domain was scanned by 91 antivirus or URL scanning engines, none of which flagged it as malicious at the time of analysis. No public evidence of SSL certificate details, HTTP response codes, Safe Browsing or OTX entries, page title, or additional evidence links has been disclosed. Consequently, the current visibility into the site’s payload, landing page, or credential‑harvesting mechanisms remains limited.
Defenders should continue to monitor the domain, enforce blocklist updates that include the observed entry, and consider adding the domain to internal URL filtering policies. Additional investigation, such as fetching the HTTP response and examining page content, is required to determine the exact phishing vector and any associated credential‑stealing forms. Until such data is obtained, the domain should be treated as a potential phishing threat consistent with its classification.