elxr24[.]shop

Analysis of elxr24.shop as of 27 July 2026 indicates the domain is currently active and associated with a generic phishing campaign. The authoritative nameservers are ns1.impreza.host, ns2.impreza.host, ns3.impreza.host, and ns4.impreza.host, which resolve the domain to the IPv4 address 37.228.129.39. The IP belongs to a hosting provider that frequently appears in abuse reports, but no additional geolocation or ASN data are provided in the available intelligence. The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy service, demonstrating that at least one defensive feed has identified it as malicious.

VirusTotal records show that the domain was submitted to 91 scanning engines; none of the engines reported a detection at the time of the scan. While the absence of detections does not guarantee the domain is benign, the lack of positive findings across a large number of vendors is noteworthy. No SSL/TLS certificate details, HTTP response codes, or page title information have been published, limiting the ability to assess transport security or content cues. Consequently, the primary observable indicators are the nameserver configuration, the single blocklist entry, the PhishDestroy block, and the VirusTotal scan result.

Defenders should continue to monitor the domain, enforce blocklist rules that include it, and consider adding it to internal URL filtering policies. Additional investigation, such as retrieving the HTTP response and analyzing any served content, would be required to determine the precise phishing vector and potential credential harvesting mechanisms. Until further evidence is gathered, the domain should be treated as malicious and prevented from reaching end users.