mng[.]veloxinv[.]com

The domain mng.veloxinv.com is currently active and flagged as high-risk generic phishing infrastructure. Registered on March 5, 2026, through Dominet (HK) Limited, the domain resolves to IP address 172.67.132.12, which is hosted on Cloudflare's network (AS13335, United States). The domain employs Cloudflare nameservers and utilizes HTTP/3, HSTS, Vue.js, and Axios technologies, indicating a modern, interactive web application likely designed to mimic a legitimate service. The page title is 'Veloxam,' and the SSL certificate is issued by Google Trust Services, lending superficial credibility to the fraudulent site.

The domain appears on three security blocklists and is flagged by three of ninety-five VirusTotal vendors, with specific blocks from PhishDestroy, MetaMask, and SEAL. The Gridinsoft trust score is zero out of one hundred, reinforcing the malicious assessment. While the exact phishing target or brand impersonated is not confirmed, the combination of a recently registered domain, low reputation score, and active blocklisting strongly suggests credential harvesting or financial fraud. The use of a dynamic JavaScript framework and API calls via Axios suggests the page may collect user input and transmit it to command-and-control infrastructure.

Uncertainties remain regarding the specific brand being targeted and the full scope of the campaign. The domain's reliance on Cloudflare may obscure the true origin of the hosting, and the phishing kit or payload in use has not been publicly identified. Defenders should treat all traffic to this domain as hostile, block it at the network level, and monitor for related subdomains or variations. Users who have visited the site should be advised to change credentials and enable multi-factor authentication on any accounts that may have been exposed. Ongoing monitoring of this domain's behavior is recommended, as phishing campaigns often evolve their tactics or redirect to new infrastructure upon detection.