ellipalextension[.]com

PhishDestroy identifies ellipalextension.com as an elevated-risk brand impersonation threat specifically targeting ELLIPAL, a crypto hardware wallet company. This domain was designed to deceive users into believing they are visiting the legitimate ELLIPAL site, likely to steal cryptocurrency credentials or seed phrases. The threat type is a crypto drainer, as the page title explicitly claims to offer secure cold wallets while the domain itself is fraudulent.

Technical indicators reveal that the domain was created on June 10, 2025, and registered through NiceNIC International Group Co., Limited. It resolves to IP address 216.198.79.65 and uses a Let's Encrypt SSL certificate (R13), which gives it a false sense of security. VirusTotal shows 2 out of 95 security vendors flagging this domain, and it appears on one security blocklist. Despite these low detection rates, the domain has already been taken offline, indicating active abuse. The brand target is across, meaning it impersonates multiple brands, but in this case specifically ELLIPAL.

Users who may have visited ellipalextension.com should immediately change their ELLIPAL account passwords and enable two-factor authentication. Since this is a crypto drainer, never enter seed phrases or private keys on any website linked from an email or ad. Always verify the official domain by typing it directly into the browser. Monitor crypto wallets for unauthorized transactions and consider using a hardware wallet with a passphrase. Report any suspicious activity to ELLIPAL support and the relevant cybercrime authorities.