ellipalsetup[.]com

The domain ellipalsetup.com was registered through NiceNIC International Group Co., Limited on 21 February 2026. Its authoritative nameservers are michael.ns.cloudflare.com and sandra.ns.cloudflare.com, and DNS resolution points to the Amazon Web Services address 216.198.79.1, which belongs to ASN 16509 (Amazon.com, Inc.) located in the United States. The site presented the page title “ELLIPAL Wallet”, indicating a crypto‑related lure, and is classified in the intelligence feed as a Crypto Scam. Technical fingerprints show the use of Vercel hosting and the presence of HTTP Strict Transport Security (HSTS) headers, yet no SSL/TLS certificate was observed, meaning the service was reachable only over plain HTTP.

VirusTotal scans recorded 2 detections out of 93 security vendors, and the domain appears on a single public blocklist. PhishDestroy has already taken the site offline, and the Gridinsoft trust score is 0 / 100, reinforcing the malicious assessment. Because the infrastructure relies on a cloud provider, the same IP address may host unrelated legitimate services, but the combination of the recent registration date, the crypto‑wallet page title, the low trust score, and vendor detections strongly suggests a short‑lived phishing operation targeting cryptocurrency users.

Defenders should block DNS resolution for ellipalsetup.com, add the IP 216.198.79.1 to network‑level deny lists, and monitor for any new domains that resolve to the same address or that use the same Cloudflare nameservers. Continuous feed updates from VirusTotal, blocklist aggregators, and phishing‑specific sinks such as PhishDestroy should be consulted for re‑appearance. Endpoint protection should flag any URLs containing “ellipalsetup.com” or matching the observed page title, and SOC analysts should treat any traffic to this host as suspicious and investigate for potential credential harvesting or malware delivery.