elentismods[.]pro

Analysis of elentismods.pro shows a newly registered site (created 21 February 2026) that is currently active and returning HTTP 307 redirects. The domain is hosted on Amazon Web Services (ASN 16509) in the United States and resolves to 216.198.79.1. TLS is provided by a Let’s Encrypt R13 certificate, and the site advertises HSTS support. Front‑end assets reveal the use of Tailwind CSS, AOS animation library, Unpkg CDN and the Vercel deployment platform, all of which are consistent with a quickly assembled phishing page. The page title reported by crawlers is “Elentis”, suggesting the site may be attempting to impersonate a brand or service named Elentis, although no further branding evidence is available.

Reputation scoring is extremely low; Gridinsoft assigns a trust score of 0 / 100. The domain is listed on one security blocklist and has been actively blocked by the PhishDestroy feed. VirusTotal scans show that 2 of 93 antivirus engines flagged the domain as malicious, confirming a degree of consensus among detection vendors. Registration details indicate the domain was purchased through NiceNIC International Group Co., Limited, and the authoritative name servers are zelda.ns.cloudflare.com and nikon.ns.cloudflare.com, both Cloudflare‑managed.

No additional intelligence such as OTX tags or Safe Browsing entries is present in the current dataset. Defenders should add 216.198.79.1 to network deny lists, enforce DNS filtering for elentismods.pro, and monitor for any outbound connections to the associated IP range. Because the site is still live and redirects may lead to credential‑harvesting pages, endpoint protection should be tuned to block any downloads or scripts originating from this host. Continuous re‑evaluation is recommended, as threat actors frequently rotate infrastructure, and the low trust score combined with the observed technology stack indicates a high‑risk phishing operation.