ellonxia[.]com[.]flonexb[.]com

The domain ellonxia.com.flonexb.com is a phishing site engaged in brand impersonation targeting Signal, a secure messaging platform. It poses as a legitimate Signal service to deceive users into disclosing sensitive information or credentials. No crypto drainer kit was detected, but the site was actively used for credential theft under the guise of Signal. As of the latest verification, ellonxia.com.flonexb.com has been taken offline.

Technical indicators confirm the elevated risk level of ellonxia.com.flonexb.com. The domain was flagged by 1 of 95 security vendors on VirusTotal, including Sophos, and appears on 1 security blocklist (PhishDestroy). It was registered through Cosmotown, Inc. on April 16, 2025, and resolves to the IP address 198.12.66.123, hosted on AS36352 (HostPapa) in the US. The SSL certificate was issued by Let's Encrypt (R12), and the observed page title was 'Tesla Safe Trade – Tesla Investment & Stocks', which does not align with the impersonated brand. Nameservers are ns1.host-forest.com and ns2.host-forest.com, and Gridinsoft assigned a trust score of 0/100.

Users who interacted with ellonxia.com.flonexb.com should immediately change any passwords entered on the site, especially for Signal or associated accounts. Enable two-factor authentication (2FA) to add an extra layer of security. Monitor accounts for unauthorized activity and report any fraudulent transactions. To help prevent further abuse, report the domain to Google Safe Browsing, PhishTank, or the impersonated brand's security team. If financial or crypto accounts were accessed, revoke any suspicious token approvals and consider transferring funds to a new wallet.