elirox[.]trading

Analysis of elirox.trading shows that the domain was registered on 12 July 2026 through Ultahost, Inc and is currently using four authoritative name servers (ns1‑ns4.ultahost.com). DNS resolution points to the IPv4 address 173.211.81.11, which is the sole hosting endpoint observed. The domain appears on a single external blocklist and has been explicitly blocked by the PhishDestroy feed, indicating prior detection as a phishing vector. VirusTotal scans report that two of ninety‑one antivirus or URL‑reputation engines have flagged the domain, confirming that at least a minority of vendors consider it malicious.

No additional public intelligence such as page title, SSL certificate details, or HTTP response codes is currently available, so the exact content served by the site cannot be verified. Given the recent creation date, the exclusive hosting on a single IP, and the presence on a known phishing feed, the risk rating is assigned as high. Defenders should treat any traffic to or from 173.211.81.11 and the domain elirox.trading as suspicious. Recommended mitigations include adding the domain and IP address to DNS‑based blocklists, firewall deny rules, and endpoint web‑filter policies.

Continuous monitoring of the IP for changes in reputation, as well as periodic rescans on VirusTotal or similar services, is advised to capture any escalation in detection coverage. Organizations that employ email security gateways should also ensure that inbound messages containing links to this domain are quarantined or rejected. Because the underlying phishing kit or targeted brand has not been disclosed, threat‑intel teams should prioritize collection of payload samples if the site becomes accessible, enabling deeper attribution and mitigation.