evm-e1[.]netlify[.]app

This domain, evm-e1.netlify.app, is under active investigation for phishing activity targeting cryptocurrency wallet users, specifically impersonating MetaMask. As of August 07, 2026, the domain appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask's internal security systems, and the SEAL anti-fraud consortium. Infrastructure analysis reveals the domain resolves to IP address 63.176.8.218, though no autonomous system number or hosting provider details are currently confirmed. A VirusTotal scan conducted by 91 vendors returned no detections; however, this absence does not confirm the domain's safety or malicious status, as phishing sites frequently evade initial detection.

The domain is hosted on Netlify, a legitimate platform often exploited for rapid phishing deployment due to its free tier and ease of use. No SSL certificate anomalies or HTTP status irregularities have been reported, though this is typical for phishing sites leveraging reputable hosting services. The exact content of the site remains unanalyzed, with no confirmed page title, brand logo, or phishing kit identified in available intelligence.

Defenders should treat this domain as high-risk for cryptocurrency-related fraud, particularly wallet credential theft or seed phrase harvesting. Network-level blocking is recommended for organizations handling digital assets, alongside monitoring for related subdomains or IP associations. Further analysis is required to determine the full scope of the campaign, including potential ties to broader phishing infrastructure or previously identified threat actor groups.