# PhishDestroy domain threat record: elitgaz.su

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/elitgaz.su/
Machine-readable companion: https://phishdestroy.io/domain/elitgaz.su/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-10 21:38:47 UTC
- Last availability or vendor check: 2026-10-22 10:27:52 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 5/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 5.23.50.50
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/019fb721-5963-70d6-81ad-071e8cd8b3a2/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/elitgaz.su
- Certificate Transparency search: https://crt.sh/?q=%25.elitgaz.su
- Web Archive lookup: https://web.archive.org/web/*/https://elitgaz.su/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
elitgaz.su is a Russian-language site that presents itself under the name ЭЛИТГАЗ, which reads as a gas-sector business. It sits on the PhishDestroy blocklist as a suspicious domain, and we have not yet assigned it a specific scheme type. PhishDestroy first saw it on 2026-10-10, and it was still online and serving content on 2026-10-19.

How the scam works
The page title is the only branding the site shows, so it is not clear what, if anything, it imitates. A small group of security vendors has independently flagged it as unsafe. That points to a risk of fraud or data theft: a business-looking front page can be used to collect contact details, logins or payments for goods and services that never arrive. Until the site's purpose is confirmed, treat any form, order or payment request on it as untrusted.

Evidence
On 2026-10-16, VirusTotal showed 5 of 92 engines flagging the domain: alphaMountain.ai, Forcepoint ThreatSeeker, Gridinsoft, Seclookup and SOCRadar. That is a minority verdict, but these are five unrelated vendors reaching the same conclusion. The domain also appears in 33 AlienVault OTX threat pulses, which means analysts have repeatedly placed it alongside other reported threat indicators. Among public blocklists, only PhishDestroy currently lists it.

Infrastructure
The site runs on IP 5.23.50.50 in the JSC TIMEWEB network in Russia, which fits its Russian-language branding and the .su zone. Its certificate comes from Let's Encrypt, so the padlock in the browser only means the connection is encrypted. It does not mean anyone has vouched for the business behind the site.

What to do
If you visited elitgaz.su, do not submit orders, personal details or card information there. If you already paid, contact your bank or card issuer about a dispute and keep any receipts or messages. If you entered a password that you also use elsewhere, change it on those other accounts and turn on two-factor authentication. Security teams should block the domain and its IP at DNS or proxy level, look for past traffic to it in their logs, and report any live abuse to the hosting provider.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/019fb721-5963-70d6-81ad-071e8cd8b3a2/
VirusTotal report: https://www.virustotal.com/gui/domain/elitgaz.su
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=elitgaz.su
Archived copy: https://web.archive.org/web/20261010214406/https://elitgaz.su/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:39:45 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/019fb721-5963-70d6-81ad-071e8cd8b3a2.png
  Captured: 2026-10-10 21:38:47 UTC
- URLScan capture: https://screenshots.phishdestroy.io/019fb721-5963-70d6-81ad-071e8cd8b3a2.png
  Source report: https://urlscan.io/result/019fb721-5963-70d6-81ad-071e8cd8b3a2/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/4b315a5b-1985-485b-bfe3-633c3bf938ab.png
  Captured: 2026-10-12 11:45:52 UTC
  Source report: https://radar.cloudflare.com/scan/4b315a5b-1985-485b-bfe3-633c3bf938ab
  SHA-256: 94bff9f07c791c96d8b3900a6228739da302b2766d7f3ed06cb8df1dfa63c24a

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T17:52:12Z",
        "uuid": "019fb721-5963-70d6-81ad-071e8cd8b3a2",
        "scanned_at": "2026-07-31T07:44:11Z",
        "final_url": "https://elitgaz.su/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://elitgaz.su/",
                "from": "http://elitgaz.su/",
                "status": 307
            }
        ],
        "ip": "2a03:6f00:6:1::517:3232",
        "domains": [
            "core-renderer-tiles.maps.yandex.net",
            "mc.yandex.com",
            "yastatic.net",
            "maps.google.com",
            "cdnjs.cloudflare.com",
            "mc.yandex.ru",
            "fonts.gstatic.com",
            "api-maps.yandex.ru",
            "maps.googleapis.com",
            "fonts.googleapis.com",
            "code.jquery.com",
            "use.fontawesome.com"
        ],
        "ips": [
            "2a02:6b8::2b8",
            "2a02:6b8::1:119",
            "2001:4860:4843:400::",
            "2a02:6b8:23::225",
            "142.251.110.94",
            "2a00:1450:4001:c1f::5f",
            "2a00:1450:4001:c17::64",
            "2a02:6b8::274",
            "2a04:4e42:200::411",
            "2606:4700:3033::ac43:8ef5",
            "104.17.24.14",
            "2a03:6f00:6:1::517:3232"
        ],
        "asns": [
            "13238",
            "15169",
            "54113",
            "13335",
            "9123"
        ],
        "countries": [
            "RU",
            "US",
            "DE"
        ],
        "link_domains": [
            "yandex.ru",
            "tech.yandex.ru",
            "pt.k-source.ru"
        ],
        "doc_hash": "2e076fb8d2b7e54461009abb586f7a58b2d8c14369d03230de4ab0d2699ade06",
        "script_hashes": [
            "d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad",
            "f29692bed02af855a1b94e4b99ac94de8b6f4a41d86ac6ac2897e47d0a0d66b2",
            "3a060d8ec00cedf42453f493bffb0ec47c1c9745c207e49c80ec7a883b7c38e4",
            "3fddc6d28aba3c13d64cfd4847c333ff48c71d4a5a58bd1a0494ca6ae8ac1bb4",
            "41ca7dc2ae7f7042d86a6ed5699fb23a6be12217a2fcb4c5a2f6c3fd283a9d10"
        ],
        "globals": [
            "$",
            "jQuery",
            "ymaps",
            "myMap",
            "myPlacemark",
            "init",
            "Foundation",
            "google",
            "module$exports$google3$maps$api$javascript$geometry$lat_lng_bounds",
            "module$exports$google3$maps$api$javascript$marker$marker",
            "litHtmlVersions",
            "litElementVersions",
            "reactiveElementVersions",
            "ym",
            "Ya",
            "yaCounter93791997"
        ],
        "cookies": [
            "ced",
            "_yasc",
            "pi",
            "i",
            "yandexuid",
            "yashr",
            "bh",
            "_ym_uid",
            "_ym_d",
            "sync_cookie_csrf",
            "_ym_isad",
            "yuidss",
            "sync_cookie_ok",
            "yabs-sid",
            "ymex",
            "receive-cookie-deprecation",
            "_ym_visorc"
        ],
        "storage_keys": [
            "_ymBRC",
            "_ym_synced",
            "_ym93791997_lsid",
            "_ym93791997:0_reqNum",
            "_ym_uid",
            "_ym_retryReqs",
            "_ym_wv2rf:93791997:0",
            "__ym_tab_guid",
            "__sak"
        ],
        "tls": {
            "san": [
                "elitgaz.su",
                "www.elitgaz.su"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR2",
            "subject": "elitgaz.su",
            "protocol": "TLS 1.3",
            "valid_to": "2026-09-18T06:44:57Z",
            "valid_from": "2026-06-20T06:44:58Z"
        },
        "domain_age_days": 2647,
        "apex_age_days": 2647,
        "tls_age_days": 41,
        "tls_valid_days": 89,
        "requests": 86,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 97,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx/1.30.3",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:03:11Z",
        "uuid": "4b315a5b-1985-485b-bfe3-633c3bf938ab",
        "scanned_at": "2026-10-12T11:45:52Z",
        "final_url": "https://elitgaz.su/",
        "status": 200,
        "history": [
            {
                "url": "https://elitgaz.su/",
                "status": 200
            }
        ],
        "dom_hash": "faee95f26a5df3538ff0e45d344a82de8c104012a54342059b960a3a6c782615",
        "doc_hash": "51a25db2fdf13ff808462f755d4fe557ca77b29bf1070541b8a6dc1b1c6a52d1",
        "domain_risks": [
            "Business",
            "Business & Economy"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "elitgaz.su",
                "type": "A",
                "value": "5.23.50.50"
            },
            {
                "name": "elitgaz.su",
                "type": "AAAA",
                "value": "2a03:6f00:6:1::517:3232"
            }
        ],
        "dnssec_valid": false,
        "ip": "5.23.50.50",
        "whois": {
            "registrar": "REGRU-SU",
            "created": "2017-10-31T09:00:07Z",
            "expires": "2026-10-31T09:00:07Z",
            "nameservers": [
                "ns1.timeweb.ru",
                "ns2.timeweb.ru",
                "ns3.timeweb.org",
                "ns4.timeweb.org"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T00:28:58Z",
        "analysis_at": "2026-10-20T02:00:18Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 4,
            "suspicious": 1,
            "undetected": 34
        },
        "detections": {
            "SOCRadar": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "malicious",
            "alphaMountain.ai": "malicious",
            "Forcepoint ThreatSeeker": "suspicious"
        },
        "reputation": 0,
        "categories": {
            "BitDefender": "porn",
            "alphaMountain.ai": "Malicious (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "compromised websites. business and economy"
        },
        "popularity": {
            "Alexa": 304094,
            "Statvoo": 304094,
            "Majestic": 213442
        },
        "registrar": "REGRU-SU",
        "first_seen": "2023-10-07T15:09:09Z",
        "dns": [
            {
                "ttl": 600,
                "type": "A",
                "value": "5.23.50.50"
            },
            {
                "ttl": 600,
                "type": "MX",
                "value": "mx1.timeweb.ru",
                "priority": 10
            },
            {
                "ttl": 600,
                "type": "NS",
                "value": "ns2.timeweb.ru"
            },
            {
                "ttl": 600,
                "type": "AAAA",
                "value": "2a03:6f00:6:1::517:3232"
            },
            {
                "ttl": 600,
                "type": "NS",
                "value": "ns3.timeweb.org"
            },
            {
                "ttl": 600,
                "type": "TXT",
                "value": "v=spf1 include:_spf.timeweb.ru ~all"
            },
            {
                "ttl": 600,
                "type": "MX",
                "value": "mx2.timeweb.ru",
                "priority": 20
            },
            {
                "ttl": 600,
                "type": "NS",
                "value": "ns4.timeweb.org"
            },
            {
                "ttl": 600,
                "type": "SOA",
                "rname": "dns.timeweb.ru",
                "value": "ns1.timeweb.ru"
            },
            {
                "ttl": 600,
                "type": "NS",
                "value": "ns1.timeweb.ru"
            }
        ],
        "dns_at": "2026-10-20T02:00:36Z",
        "jarm": "29d29d00029d29d00042d42d0000002059a3b916699461c5923779b77cf06b",
        "cert": {
            "san": [
                "elitgaz.su",
                "www.elitgaz.su"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "5b9d0e787919583c9919e7f1ee21c07e6a9",
            "sha256": "e4c24c7c4b4c9287a1c27c8a0d3ea3ba100338066b631c762a6e475181732852",
            "subject": "elitgaz.su",
            "valid_to": "2026-12-04T11:42:29Z",
            "valid_from": "2026-09-05T11:42:30Z"
        },
        "whois": {
            "registrar": "REGRU-SU"
        }
    }
}
```