evmhub[.]app

The domain evmhub.app was observed on July 24, 2026 and is presently offline. Technical analysis shows that the site resolved to the IP address 188.114.97.3, which belongs to the AS13335 network operated by Cloudflare, Inc., and is geolocated to the United States. The authoritative name servers finley.ns.cloudflare.com and gigi.ns.cloudflare.com confirm that the domain is hosted behind Cloudflare’s edge infrastructure, and the presence of HTTP/3 indicates usage of modern transport protocols. The TLS certificate presented by the site is issued by Google Trust Services under the WE1 designation, implying a valid, publicly trusted certificate chain.

The only visible page element captured is the title "Just a moment...," which provides no functional insight into the content or intended victim interaction. Gridinsoft assigned a trust score of 0 out of 100, reflecting an extreme lack of confidence in the domain’s legitimacy. VirusTotal scanned the domain and recorded three detections out of ninety‑five participating security vendors, indicating that at least a minority of scanners flagged the host as malicious. Additionally, the domain appears on a single security blocklist and has been listed by the PhishDestroy mitigation service, corroborating the suspicion of phishing activity.

Registration information lists Cloudflare, Inc. as the registrar, offering no further attribution. The limited data set leaves the precise phishing campaign details—such as the targeted brand, credential‑harvesting methodology, or exploit kit—undetermined. Defenders should continue to block any outbound connections to 188.114.97.3, update detection rules to include the domain name and its associated IP, and monitor for re‑registration or similar infrastructure reuse. The combination of low trust scoring, partial vendor detections, and blocklist inclusion suggests elevated risk, and organizations should treat any traffic involving evmhub.