elavonportals[.]to

This domain, elavonportals.to, is currently active and classified as a generic phishing campaign with a high risk rating. The authoritative nameservers are georgia.ns.cloudflare.com and ram.ns.cloudflare.com, indicating that the domain is hosted behind Cloudflare’s CDN. Registration details list the Government of Kingdom of Tonga as the registrar. DNS resolution points to IP address 188.114.97.3, which belongs to Cloudflare, Inc. (located in Canada). The site presents a valid TLS certificate issued by Let’s Encrypt (certificate identifier YE2) and responds with HTTP 200 over HTTP/3, employing Cloudflare Browser Insights. VirusTotal analysis shows that 17 out of 91 security vendors have flagged the domain, and AlienVault OTX includes it in two separate threat‑intelligence pulses. The domain is presently listed on three public blocklists and is blocked by the PhishDestroy, MetaMask, and SEAL filters. While the page title is limited to “Index of /”, no further content has been disclosed, leaving the exact phishing payload unknown. Defenders should block the domain at network perimeter, monitor DNS queries for the associated IP and nameservers, and add the domain to internal threat‑intel feeds. Ongoing observation is recommended to detect any changes in hosting or content.