elnibras[.]com

The domain elnibras.com is currently flagged as an active generic phishing site. Infrastructure analysis shows the domain resolves to the Turkish name servers ns1.hosting.com.tr and ns2.hosting.com.tr, and it was registered through Realtime Register B.V. The HTTP response returns a 301 redirect, indicating the site is actively serving content that may forward victims to a malicious payload. The domain appears on a single security blocklist and is listed as blocked by the PhishDestroy feed, confirming that at least one reputable anti‑phishing service has taken mitigation action. VirusTotal records indicate the domain was examined by 91 scanning engines, none of which reported a detection at the time of analysis; this absence of detections does not constitute validation of safety.

No SSL certificate information is available, and the hosting IP address has not been disclosed, limiting the ability to attribute the infrastructure to a specific autonomous system or geographic region. The precise phishing vector, target brand, and page title have not been disclosed, creating uncertainty about the exact content delivered to victims. Security teams should continue to monitor DNS activity for the listed name servers, enforce blocking of the domain at network perimeter and proxy layers, and incorporate the domain into internal blocklists.

Review outbound traffic logs for connections to the resolved IPs of the two Turkish name servers, and consider sharing this indicator with upstream providers to enrich detection rules. Ongoing re‑scans with VirusTotal and other sandbox services are advised to capture any emerging payloads. Until further evidence is gathered, the domain should be treated as malicious.