ellipal-wallets[.]web[.]app

Analysis performed on July 24, 2026 indicates that the domain ellipal-wallets.web.app is currently offline and returns HTTP 404 for the sole observed URL. The page title returned during the scan is "Hardware Wallet Tutorial | ELLIPAL Titan Cold Wallet Q&A", which suggests an attempt to associate the site with the legitimate ELLIPAL hardware‑wallet brand. The domain is hosted on Google Firebase infrastructure, employs HTTP/3 and enforces HSTS, and is served over TLS using a certificate issued by Google Trust Services under the WR4 intermediate. DNS resolution points to the IP address 199.36.158.100, which belongs to AS54113 Fastly, Inc. and is geolocated in the United States.

The hosting provider and CDN configuration are consistent with many legitimate Firebase deployments, but the combination of a 404 response, the "Crypto Scam" classification, and the presence on a security blocklist indicate malicious intent. The domain appears on one blocklist and is listed as blocked by PhishDestroy. VirusTotal analysis shows that three out of ninety‑five scanning engines flagged the domain, reinforcing the suspicion of abuse. Registration details reveal that the domain was provisioned through Google LLC, a common registrar for Firebase‑based sites, which does not provide any protective indication of legitimacy in this context.

No additional evidence such as screenshots, login forms, or malicious payloads were captured during the scan, leaving the exact delivery mechanism of the alleged crypto‑draining activity unknown. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurgence of the IP address or related subdomains, and consider adding the host to internal blocklists. Threat intelligence teams should correlate any observed attempts to contact the IP 199.36.158.100 with known crypto‑drain campaigns, and if possible, request additional indicators from the three vendors that reported detections.