evmpoll[.]cc

The domain evmpoll.cc was registered through Web Commerce Communications Limited and first observed on 12 July 2025. DNS resolution points to the single IPv4 address 185.102.115.49, which is advertised as belonging to AS205775 operated by NEON CORE NETWORK LLC and is geolocated in Germany. No TLS certificate is presented for the host, indicating that HTTPS is not available. The only page title retrieved before the site was taken offline reads “Nur einen Moment…”, a generic German phrase that provides no indication of legitimate purpose.

Threat intelligence shows that evmpoll.cc appears on one public security blocklist and is explicitly blocked by the PhishDestroy service. A VirusTotal scan returned three detections out of ninety‑five scanners, confirming that a minority of AV engines consider the domain malicious. No additional nameserver information beyond a single authoritative server is disclosed, and the site’s current status is listed as offline. Based on the available evidence, the domain exhibits the typical indicators of a generic phishing infrastructure: recent registration, single‑IP hosting, lack of encryption, presence on a blocklist, and multiple vendor detections.

However, the limited public data—such as the absence of a detailed page capture, lack of known phishing kit references, and the generic page title—prevents a full attribution of the phishing campaign’s target or payload. Defenders should treat evmpoll.cc as malicious; immediate actions include adding the domain and its IP address to network deny lists, ensuring web filtering solutions block any HTTP request to the host, and monitoring for any resurrection attempts. Continuous re‑query of reputation services is advised in case the domain is re‑hosted or the threat actor reinstates the site.