evgroupes[.]com

This domain, evgroupes.com, is identified as a generic phishing site designed to impersonate corporate login portals. Analysis indicates the infrastructure was engineered to capture enterprise credentials through deceptive authentication forms, though no specific brand impersonation or crypto drainer kit has been conclusively linked to this instance. The site employs standard phishing tactics, including cloned login interfaces and urgency-driven prompts, to trick victims into submitting sensitive information. Infrastructure analysis reveals the following technical indicators: the domain was registered through Dynadot Inc and resolves to the IP address 78.40.197.253. It was created on May 13, 2026, an anomalous future date suggesting potential domain spoofing or registry manipulation. VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and was actively blocked by PhishDestroy prior to takedown. No Google Safe Browsing (GSB) records were found for this domain, indicating it may not have been widely disseminated or was detected before GSB inclusion. As of the latest verification, evgroupes.com has been taken offline, likely due to registrar intervention or hosting provider action. However, residual risk remains due to the domain's registration persistence and the possibility of infrastructure reuse. Organizations are advised to monitor for related domains using the same IP or registrar, as threat actors frequently rotate infrastructure. Network defenders should update blocklists to include the domain and associated IP, while end-users should be trained to recognize anomalous login prompts and verify domain authenticity before entering credentials.