velarix24[.]com

PhishDestroy first observed velarix24.com on Feb 26, 2026. The captured page title is “Apache2 Ubuntu Default Page: It works”. Current evidence score: 100/100 (critical).

Positive findings are stored from 3 sources: VirusTotal, DNS security resolvers, and Cloudflare Radar. VirusTotal recorded 18 detections among 95 engines: ADMINUSLabs, alphaMountain.ai, BitDefender, Cluster25, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, Seclookup, SOCRadar, Sophos, VIPRE, Webroot on Jul 18, 2026 at 18:45 UTC. DNS security checks returned 9 blocking results across 13 tested policies: Adguard Default, Adguard Family, Cloudflare Family, Cloudflare Security, Control D Adblock, Control D Malware, Mullvad Adblock, Opendns Standard, Quad9 Secure; no observation timestamp was retained. Cloudflare Radar classified the hostname as malicious and assigned the categories phishing, security threats, new domains, and security risks; its verdict timestamp was not retained. Non-positive and contextual checks: The external blocklist snapshot contained no matches on Aug 7, 2026 at 22:20 UTC. Google Safe Browsing returned no flag on Mar 2, 2026 at 20:49 UTC. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 03:16 UTC. PhishStats returned no feed match on Mar 1, 2026 at 13:12 UTC.

HTTP 200 was recorded on Aug 7, 2026 at 22:15 UTC. Registration records for the domain list Gname.com Pte. Ltd. as the registrar and Feb 21, 2026 as the creation date. Registration preceded first observation by 5 days. At collection time, the hostname resolved to 0.0.0.0. The recorded endpoint location is --. The stored server header is nginx. DOM analysis on Jul 28, 2026 at 02:20 UTC returned 88/100. The evidence archive retains 1 visual capture from PhishDestroy. TLS metadata lists PhishDestroy / botadmin.destroy.tools as the certificate issuer with validity through Jan 6, 2036; checked Aug 2, 2026 at 01:02 UTC.

The content indicators and 3 positive source findings support the current phishing classification. The stored fields do not identify an impersonated brand or victim interaction.