evmevmevmecmecm[.]icu

The domain evmevmevmecmecm.icu was registered on February 21, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IP address 188.114.97.3, which is announced by AS13335 Cloudflare, Inc. and geolocated to the United States. DNS resolution is served by the Cloudflare authoritative nameservers barbara.ns.cloudflare.com and evan.ns.cloudflare.com. An SSL certificate issued by Google Trust Services under the label WE1 is presented, indicating a valid TLS handshake. The HTTP response returned status code 200 and the page title reported by the server is "Trust Wallet - Crypto Card," confirming that the site is attempting to impersonate the Trust Wallet brand.

Technical fingerprints show a Node.js application running on the Express framework, with traffic accelerated via Cloudflare and HTTP/3 support. Threat intelligence sources flag the domain as a crypto‑related scam: it appears in one AlienVault OTX pulse and is listed on a single security blocklist. PhishDestroy has actively blocked the domain, and VirusTotal analysis records nine of ninety‑three security vendors labeling the site as malicious. The current operational status is offline, suggesting the hosting has been taken down or the site is no longer serving content.

While the available data confirms brand impersonation and a crypto‑scam classification, the exact payload, credential‑harvesting mechanisms, or user‑interaction flow remain unverified because no deeper content analysis has been published. Defenders should continue to block DNS resolution for evmevmevmecmecm.icu, add the domain to web‑filtering and intrusion‑prevention rule sets, and monitor for any future re‑registration or use of similar Cloudflare‑hosted infrastructure. Ongoing correlation with threat‑intel feeds, especially updates to AlienVault OTX and VirusTotal, is recommended to capture any resurgence of malicious activity.