btcvellorix[.]fr

The domain btcvellorix.fr was registered on February 21 2026 through Dynadot LLC and is currently taken offline. The authoritative nameservers are malavika.ns.cloudflare.com and wesley.ns.cloudflare.com, which resolve the domain to the Cloudflare IP address 172.67.172.216 located in the United States under AS13335. No TLS certificate is presented, indicating that HTTPS connections are not available. The page title observed before takedown reads “BTC 8.3 Vellorix — a crypto earning tool with military‑grade safety”, which aligns with the listed scam type of a crypto scam and the broader classification of brand impersonation targeting “across”. Google Safe Browsing flags the domain for social engineering, and three independent blocklists (PhishDestroy, MetaMask, SEAL) have listed it as malicious.

A Gridinsoft trust score of 0 out of 100 further confirms the lack of credibility. VirusTotal analysis shows that six of ninety‑three scanning engines returned a detection, reinforcing the malicious assessment. The domain appears on three additional security blocklists, though the specific list names are not provided. The combination of a recent registration, lack of TLS, low trust score, multiple blocklist entries, and a socially engineered page title strongly suggests that the site was used to lure victims into a cryptocurrency‑related fraud, possibly by impersonating legitimate brands under the generic “across” label.

Because the site is offline, direct content inspection is not possible, leaving the exact payload and victim interaction unknown. Defenders should continue to block the domain at perimeter devices, monitor DNS queries for the associated IP and nameservers, and add the domain to internal blacklists. Threat intelligence feeds should be updated with the registration date, registrar, and hosting details to aid correlation with other observed campaigns. Ongoing observation of the Cloudflare IP may reveal re‑use for future malicious infrastructure.