eleon[.]finance

The domain eleon.finance was registered on February 21, 2026 through NiceNIC International Group Co., Limited and remains active as of the report date, July 25, 2026. DNS resolution points to the IP address 188.114.96.3, which belongs to AS13335 operated by Cloudflare, Inc., and is geolocated in the United States. The authoritative nameservers are mark.ns.cloudflare.com and aspen.ns.cloudflare.com, confirming that the domain is hosted behind Cloudflare’s edge network. The site serves content over HTTPS with a certificate issued by Google Trust Services under the WE1 intermediate, and HTTP responses return a status code of 200.

Detected web technologies include HTTP/3 and HTTP Strict Transport Security (HSTS), both provided by Cloudflare. Security telemetry shows that three of ninety‑five antivirus engines on VirusTotal flagged the domain, indicating a modest but non‑trivial detection rate. Gridinsoft assigned a trust score of zero out of one hundred, and the domain appears on a single security blocklist. PhishDestroy has explicitly blocked the domain, and additional blocklist entries are referenced in public threat feeds.

The page title returned by the server is "Eleon Finance," but no further content analysis is available, leaving the exact phishing lures or credential‑harvesting mechanisms unverified. Given the combination of a newly created domain, Cloudflare‑based hosting, a low trust score, multiple vendor detections, and active blocklist listings, the infrastructure exhibits characteristics typical of high‑risk generic phishing operations. Defenders should add eleon.finance to network‑level deny lists, enforce DNS sinkholing where feasible, and monitor outbound connections to the associated IP address 188.114.96.3. Continuous re‑evaluation of the domain’s detection status across threat intelligence platforms is advised, as additional indicators may emerge if the site begins to serve phishing payloads or expands its targeting scope.