evmnet[.]cc

The domain evmnet.cc was registered on May 16, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is presently resolved to the Cloudflare‑hosted address 104.21.94.244, located in Canada. The site presents a valid HTTPS certificate issued by Let’s Encrypt (E7) and returns HTTP 200 responses, indicating an operational web server. Its authoritative name servers are johnny.ns.cloudflare.com and rayne.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure.

Infrastructure analysis shows a low Gridinsoft trust score of 23 out of 100, and the domain appears on three independent security blocklists. It has been explicitly blocked by multiple anti‑phishing filters, including PhishDestroy, MetaMask, and SEAL, suggesting that known malicious payloads or credential‑harvesting pages have been observed. The domain also surfaces in a single AlienVault OTX pulse, providing additional community‑level corroboration of its malicious use.

VirusTotal scans have flagged evmnet.cc in eight out of ninety‑five antivirus engines, reinforcing the suspicion of malicious activity despite a modest detection rate. The combination of a recent registration date, active HTTPS service, and presence on reputable blocklists aligns with behaviors typical of credential‑stealing operations targeting cryptocurrency or financial services. However, the exact phishing template, targeted brands, or victim demographics remain unclear from the publicly available data.

Defenders should prioritize adding evmnet.cc to network deny lists and enforce DNS‑level blocking to prevent client access. Continuous monitoring of the associated IP address and any newly observed sub‑domains is advisable, as the underlying Cloudflare infrastructure can be repurposed for fast‑flux hosting. Incident response teams should also correlate internal logs for any outbound connections to 104.21.94.244 and investigate potential credential capture attempts originating from this endpoint.