xn--elvasdajooks-bjba0g[.]ee

The domain xn--elvasdajooks-bjba0g.ee was registered on February 21, 2026 through Zone Media OÜ and currently resolves to the IP address 65.21.209.106, which belongs to Hetzner Online GmbH (AS24940) in Finland. The web server presents an HTTP 200 response and serves a TLS certificate from Let’s Encrypt (E8). Header analysis shows the server stack includes Nginx and a reCAPTCHA challenge. The page title returned is “Elva Südaööjooks”. The domain is listed on one public blocklist and is actively blocked by PhishDestroy. VirusTotal reports six detections out of 93 scanned vendors, and Gridinsoft assigns a trust score of 0 / 100. It appears in a single AlienVault OTX pulse and uses the nameservers ns2.zone.ee, ns3.zonedata.net, and ns.zone.eu. The classification is generic phishing with a high risk rating and the status remains active. While the page title is known, the exact content and any credential‑capture mechanisms have not been publicly disclosed. Defenders should add the domain and its IP to blocklists, monitor DNS queries for the listed nameservers, and consider sinkholing the address to disrupt traffic. Continuous re‑scanning with malware‑analysis services is advised to detect any evolving payloads.