wojak[.]5a-evmcheck[.]lol

Analysis of the domain wojak.5a-evmcheck.lol shows a newly registered Internet property that is currently classified as a generic phishing threat. The domain was created on August 03, 2026 and is registered through Dynadot Inc. It resolves to the IP address 188.114.97.3 and uses Cloudflare name servers nicole.ns.cloudflare.com and rex.ns.cloudflare.com. The domain is listed on one security blocklist and has been blocked by the PhishDestroy service, confirming that external threat‑intelligence sources consider it malicious.

VirusTotal reports that the domain has been scanned by 91 AV vendors, with none reporting a detection at the time of analysis; this lack of detection does not imply safety, as many phishing sites evade signature‑based detection. No public SSL certificate details, HTTP response codes, Safe Browsing status, or page title information are available, leaving the web‑content layer unverified. The limited visibility means that defenders cannot confirm the exact phishing vector, landing page, or targeted brand, only that the domain is associated with phishing activity.

Given the active status and the fact that the domain is already subject to blocklist inclusion, security teams should consider adding the domain to outbound filtering rules, monitor DNS queries for the associated IP, and continue to track any future VirusTotal or community submissions. Ongoing investigation is advised to capture any emerging indicators such as payload signatures, credential‑stealing forms, or redirects that may later appear in threat feeds.