epavall[.]ma

This domain is flagged as a generic phishing threat with high risk level. Registered via HEBERFACILE on May 20, 2024, and currently active as of July 18, 2026, the domain resolves to IP address 149.255.58.87. Its nameservers—ns1.heberhost.com through ns4.heberhost.com—point to the heberhost infrastructure. An SSL certificate issued by Let's Encrypt R13 is present, which is typical for quick deployment but not inherently malicious. Threat intelligence sources confirm the domain's malicious nature: AlienVault OTX lists it in six threat intelligence pulses, indicating sustained or multiple-party reporting, and VirusTotal shows 13 out of 91 security vendors flagging it as malicious, providing strong corroboration from diverse detection engines. The exact phishing method or brand targeted is not specified in available data; the site's content remains unanalyzed, so defenders should treat it as a generic phishing domain until further investigation. Uncertainties include whether this is a credential harvester, malware dropper, or redirector, and whether it impersonates a specific organization. Defenders should block the domain and its IP 149.255.58.87 at email and web gateways, monitor for any associated subdomains or newly registered lookalike domains using the same HEBERFACILE registrar or heberhost nameservers, and conduct sandboxed access to the live site to document the phishing template and identify any targeted brands. The domain's active status and multi-source detection warrant immediate containment.