evriiouk[.]qpon

Analysis indicates that the domain evriiouk.qpon was registered on 12 June 2026 through Namemart Limited and presently resolves to the IPv4 address 104.21.48.1. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service. Google Safe Browsing flags the domain for social engineering, confirming that it is being used to lure users into credential‑harvesting or other malicious interactions.

VirusTotal data shows that 16 of 91 scanned security vendors have flagged the domain as malicious, providing a multi‑vendor consensus that the site is associated with phishing activity. These observable indicators—blocklist presence, Safe Browsing classification, and multi‑vendor detections—collectively point to a high‑risk generic phishing operation. No additional evidence such as SSL certificate details, HTTP status codes, page titles, or content snapshots is presently available, leaving the exact landing‑page structure and targeted brand undefined.

Defenders should immediately add the IP address 104.21.48.1 to network deny lists, enforce DNS filtering for evriiouk.qpon, and ensure that endpoint protection solutions ingest the domain into their URL reputation feeds. Incident response teams should treat any user‑initiated connections to the domain as potential credential‑theft attempts and monitor for related IOCs. Continuous intelligence gathering is advised to capture any emerging indicators, such as new blocklist entries or additional vendor detections, that may clarify the campaign’s scope and target profile.