vellius[.]trade

The domain vellius.trade is identified as a cryptocurrency-focused phishing infrastructure designed to deceive users into disclosing wallet credentials or transferring digital assets. Analysis indicates this is not a generic phishing attempt but one specifically targeting cryptocurrency transactions or wallet management interfaces. As of the latest verification, the domain has been taken offline, displaying a Cloudflare 522 connection timeout error. Infrastructure analysis reveals technical indicators consistent with phishing operations. The domain was registered through NiceNIC International Group Co., Limited on February 21, 2026, with an SSL certificate issued by Google Trust Services. It resolves to the IP address 188.114.96.3 and employs modern web technologies including Node.js, React, Next.js, and Webpack, alongside Cloudflare for content delivery and protection. Detection metrics show the domain was flagged by 2 of 95 security vendors on VirusTotal, received a trust score of 0/100 from Gridinsoft, and appears on one security blocklist. The use of HTTP/3 and Cloudflare Browser Insights suggests an attempt to mimic legitimate, high-performance financial platforms. Current status confirms the domain is offline, though the underlying infrastructure remains a potential risk if reactivated. Organizations and individuals are advised to block the domain and associated IP address 188.114.96.3 at the network perimeter. Cryptocurrency users should verify all wallet addresses independently and avoid interacting with unsolicited communications referencing vellius.trade. Security teams are recommended to monitor for new registrations from the same registrar or IP range, as threat actors frequently rotate domains to evade detection. The creation date discrepancy (2026) may indicate domain squatting or an attempt to bypass reputation-based filters.