andelira[.]net

The domain andelira.net was registered on February 21, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently active. DNS resolution points to 188.114.97.3, an address owned by AS13335 Cloudflare, Inc., located in the United States. The authoritative name servers are nataly.ns.cloudflare.com and randy.ns.cloudflare.com, confirming that the domain is fully proxied behind Cloudflare’s network and serves content over HTTP/3. An HTTPS certificate issued by Google Trust Services (WE1) is in place, indicating a valid TLS handshake despite the malicious intent. HTTP requests receive a 301 redirect response, a pattern often used to forward victims to a phishing landing page while obscuring the original URL.

The page title returned from the server reads "Andelira - Plataforma Oficial | Trading IA 2025 | Más de 10.000 Reseñas," which suggests an attempt to masquerade as a financial or AI‑driven trading service, though no further page content has been captured for analysis. Reputation scoring from Gridinsoft assigns a zero‑out‑of‑hundred trust score, and the domain appears on a single security blocklist. It is actively blocked by PhishDestroy, reflecting that at least one commercial phishing mitigation service has identified it as malicious. VirusTotal scans report that two of ninety‑five security vendors flag the domain, providing independent confirmation of suspicious activity.

The combination of a recent registration date, low trust score, active blocklist entry, and partial vendor detections indicates a high‑risk phishing operation. Uncertainty remains regarding the specific phishing vector, credential collection mechanisms, and any associated infrastructure beyond the primary IP address. Defenders should add the domain to deny‑list policies at network borders, enforce DNS sinkholing where possible, and monitor outbound connections to the Cloudflare‑served IP for anomalous traffic.