5a-evmcheck[.]lol

Analysis on 5a-evmcheck.lol, observed on 2026-08-03, indicates active phishing infrastructure targeting users of cryptocurrency wallets. The domain has been added to three independent security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal records show the domain was submitted to 91 AV engines; none of the scanners raised a detection, which does not constitute a safety assurance.

No public WHOIS data, IP address, hosting provider, ASN, or SSL certificate details have been released in the current intelligence set, and the page title or any brand affiliations have not been disclosed. Consequently, the precise victim profile, lure technique, and payload delivery method remain unknown. The lack of detections combined with multiple blocklist listings suggests that the domain is being used in a coordinated campaign, possibly as a redirector or drop point for malicious content.

Defenders should immediately add 5a-evmcheck.lol to network and endpoint deny lists, monitor DNS query logs for look-ups, and enforce URL filtering rules that include the known blocklist entries. Continuous re-evaluation is advised as additional telemetry becomes available, particularly any observed HTTP responses, TLS certificates, or content snapshots that could clarify the phishing narrative. Until further evidence emerges, the domain should be treated as high-risk for credential harvesting or crypto-related scams.