nvda[.]5a-evmcheck[.]lol

The domain nvda.5a-evmcheck.lol is currently classified as a generic phishing site and remains active as of the report date, August 03, 2026. Registration data indicates the domain was created on August 03, 2026 through Dynadot Inc, and it is hosted behind Cloudflare infrastructure, as evidenced by the presence of Cloudflare Browser Insights, Cloudflare services, and HTTP/3 support. The authoritative nameservers nicole.ns.cloudflare.com and rex.ns.cloudflare.com resolve the domain to the IP address 188.114.97.3, confirming the use of Cloudflare’s edge network for content delivery.

The domain has been blocked by the PhishDestroy mitigation service and appears on a single security blocklist, demonstrating that at least one external threat intelligence feed has flagged the domain for malicious activity. VirusTotal reports that the domain has been scanned by 91 antivirus vendors, with none of the scanners generating a detection; however, the absence of detections does not constitute evidence of safety and should be interpreted as a lack of current signatures rather than a clean bill of health. No additional public intelligence such as Safe Browsing alerts, OTX indicators, SSL certificate details, HTTP status codes, or trust‑score metrics are available in the supplied data, and the page title or specific phishing content has not been disclosed.

Consequently, the precise tactics, techniques, and procedures employed by the campaign remain uncertain, and analysts should treat the domain as potentially harmful until further content analysis is performed. Defenders are advised to proactively block the domain at network perimeters, update intrusion‑prevention signatures to include the IP address 188.114.97.3, and monitor for any future detections or reputation changes.