receive-velodrome[.]app

On July 24, 2026 the domain receive-velodrome.app was observed hosting a brand‑impersonation page targeting the Velodrome brand. The site presented the HTML title “רק רגע…”, which translates to “Just a moment…”, and did not serve an SSL certificate, indicating it was reachable only over plain HTTP. DNS resolution returned the address 172.67.171.32, an IP owned by Cloudflare, Inc. (AS13335) located in the United States. Both authoritative name servers, adam.ns.cloudflare.com and danica.ns.cloudflare.com, belong to Cloudflare, confirming that the domain was registered through Cloudflare, Inc. The infrastructure assessment shows a Gridinsoft trust score of 0 / 100, reflecting a very low reputation.

VirusTotal scanned the domain and recorded 2 detections out of 95 scanning engines, demonstrating that at least a small subset of security products flagged the site as malicious. The domain appears on a single external blocklist, PhishDestroy, which has also taken the site offline. Current HTTP status is reported as offline, indicating that the malicious page is no longer publicly reachable. Evidence gaps remain: no detailed payload or credential‑harvesting mechanism has been disclosed, and the exact content of the landing page beyond the title has not been captured.

Analysts cannot confirm whether additional redirect chains or exploit kits were employed. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the associated Cloudflare IP range, and update any URL‑based allowlists to include the observed hostnames. Given the low trust score, the presence on a blocklist, and the partial VirusTotal detections, the domain should be treated as malicious and included in threat‑intel feeds. Ongoing observation of the underlying IP and registrar may reveal new phishing campaigns that reuse the same Cloudflare infrastructure.