cab[.]ellysian-ltdcapital[.]com

On July 24, 2026 analysts observed that the domain cab.ellysian-ltdcapital.com is being used for brand impersonation aimed at credential theft. The site is currently offline, but historical data shows it was blocked by PhishDestroy and appears on at least one public security blocklist. DNS resolution points to the IP address 104.21.55.249, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The domain is hosted on Cloudflare’s network and uses the authoritative nameservers janet.ns.cloudflare.com and quinton.ns.cloudflare.com.

Registration was performed through Tucows Domains Inc. on November 24, 2025, indicating a relatively new registration. A Gridinsoft trust score of 0 out of 100 underscores the lack of any reputation for the domain. The page title returned by the server is "Elysian Capital," matching the brand reference in the intelligence, but no SSL certificate was presented, leaving the connection unencrypted. VirusTotal scans flag the domain in 2 of 95 security vendor engines, providing modest but notable detection evidence.

No additional details about the page content, login forms, or phishing kits have been released, so the exact visual spoofing tactics remain unverified. Defenders should continue to block the domain at perimeter filters, update URL blocklists, and monitor the associated IP address for any resurgence. Given the elevated risk rating and concrete infrastructure indicators, proactive remediation is advised to prevent credential compromise attempts targeting the Elysian Capital brand.