ellipalwallets[.]pages[.]dev

This domain is flagged as a brand impersonation threat targeting users of ELLIPAL, a hardware cryptocurrency wallet provider. The site presents itself as the official ELLIPAL wallet platform, using the page title 'ELLIPAL Wallet – Secure Cold Storage for Your Crypto Assets' to deceive visitors into entering sensitive information such as wallet recovery phrases, private keys, or login credentials. Given the rise of cryptocurrency-related phishing, this site poses a significant risk of financial loss for individuals who mistake it for the legitimate ELLIPAL service.

Analysis indicates the domain was registered on September 10, 2025, through Cloudflare, Inc., a provider commonly used for both legitimate and malicious hosting. The site resolves to the IP address 172.66.47.77, which is part of Cloudflare’s network (AS13335). Despite its active status and SSL certificate issued by Google Trust Services, the domain has not yet been widely detected by security vendors, with a VirusTotal score of 0 out of 95 detections. It appears on only one security blocklist at this time, suggesting early-stage deployment or evasion tactics.

If you visited ellipalwallets.pages.dev and entered any sensitive information, immediate action is required. Disconnect the device used from the internet to prevent further data exfiltration. Assume any credentials, recovery phrases, or private keys shared are compromised and transfer assets to a new, secure wallet. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where possible. Report the incident to the legitimate ELLIPAL support team and consider filing a complaint with relevant cybercrime authorities. Do not interact with the domain further, and verify all future communications through official ELLIPAL channels.