ellipalrestore[.]com

Analysis of ellipalrestore.com shows the domain was registered on 30 May 2025 through OwnRegistrar, Inc. The authoritative nameservers listed are olivia.ns.cloudflare.com and yew.ns.cloudflare.com, indicating the site was hosted behind Cloudflare’s network (AS13335, United States). DNS resolution points to IP 172.67.169.18, a Cloudflare edge address commonly used for content delivery and proxying. No TLS certificate was observed; the site served without HTTPS, which is atypical for legitimate services and may facilitate credential capture. The page title returned by the live host was “Nur einen Moment…”, a German phrase meaning “Just a moment…”, but no further content has been captured because the service has been taken offline.

The domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy, suggesting prior detection as malicious. A VirusTotal scan involving 95 antivirus and URL‑reputation engines recorded no detections, though the absence of flags does not constitute validation of safety. Independent assessment by Gridinsoft assigned a trust score of 0 out of 100, reinforcing the low confidence in the domain’s legitimacy.

The limited data set leaves several uncertainties: the exact phishing campaign, targeted brand, and any payload or credential‑stealing mechanisms remain unknown, as no malware hashes, phishing kit identifiers, or redirect chains have been disclosed. Defenders should continue to block ellipalrestore.com at perimeter firewalls and DNS resolvers, monitor for any future DNS changes that could point to new IP addresses, and incorporate the domain into threat‑intel feeds. Given its recent creation date, Cloudflare‑based hosting, and low trust scores, the domain should be treated as high‑risk until further forensic evidence becomes available.