evmhub[.]ltd

evmhub.ltd was registered on June 08, 2026 and has already been observed in three public security blocklists. The domain is listed by PhishDestroy, MetaMask, and SEAL as a blocked resource, confirming that multiple anti‑phishing services have taken protective action. VirusTotal scans show that five out of ninety‑one security vendors returned a positive verdict on the domain, indicating that detection signatures are beginning to surface but are not yet universal. The presence on three blocklists within weeks of registration suggests an active abuse campaign, likely targeting users of cryptocurrency wallets or decentralized applications, as implied by the involvement of MetaMask in the blocklist.

No additional technical artifacts such as IP address, hosting provider, SSL certificate details, or HTTP response codes are available in the current intelligence set, leaving the underlying hosting infrastructure uncharacterized. Likewise, the page title and any brand‑specific lures have not been disclosed, so the exact phishing lure cannot be confirmed at this time. Defenders should add evmhub.ltd to outbound filtering rules, enforce DNS‑level blocking, and monitor for any newly observed resolvers or CNAME records that may point to the domain.

Continuous re‑evaluation of VirusTotal and other sandbox results is recommended, as additional vendor detections may emerge. Organizations that rely on wallet extensions or blockchain services should educate users about unsolicited login prompts and enforce multi‑factor authentication where possible. Because the domain is newly created, rapid takedown requests to the registrar may be effective if the abuse is verified.