ellx[.]pages[.]dev

Ellx.pages.dev was observed hosting a page titled “ELIXIR TOKEN AIRDROP”. The site resolves to 172.66.44.75, an address owned by Cloudflare (AS13335) located in the United States. Registration data shows the domain was created on 23 April 2024 and is serviced by the Cloudflare nameservers renan.ns.cloudflare.com and sneh.ns.cloudflare.com. The HTTP response returned a 403 status code and the server advertised HSTS, HTTP/3 and the Cloudflare CDN, confirming the use of Cloudflare’s edge infrastructure. Security‑vendor aggregators have flagged the domain.

VirusTotal reports 12 of 94 scanned engines marking the host as malicious, and the domain appears on three independent blocklists. It has been specifically listed by PhishDestroy, MetaMask and SEAL as a “Fake Airdrop” campaign, matching the “Airdrop Scam” phishing kit identified in the payload. Gridinsoft assigned a trust score of 0 / 100, indicating a high confidence of malicious intent. The current operational status is offline, with the site returning HTTP 403, but historical evidence confirms it was actively serving the fraudulent airdrop page before takedown. The evidence points to a classic cryptocurrency‑airdrop deception, leveraging the recognizable “Elixir Token” name to lure victims into submitting private keys or wallet credentials.

While the page content itself has not been captured, the combination of the page title, kit attribution, and multiple vendor detections provides sufficient confidence to classify the domain as a high‑risk phishing vector. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration of similar sub‑domains under the same registrar, and enforce user awareness training that warns against unsolicited token airdrop offers. Threat‑intel feeds should be updated with the domain, its IP address, and associated blocklist identifiers to prevent future exposure.