veloraswap[.]xyz

This domain, veloraswap.xyz, operates as a cryptocurrency wallet phishing site designed to deceive users into connecting their Web3 wallets. The site mimics legitimate decentralized exchange interfaces, presenting a "Web3 Connect Demo" page title to trick victims into entering sensitive credentials or approving malicious transactions. Such attacks typically result in unauthorized access to digital assets, leading to immediate financial loss for affected users. Analysis indicates this domain was registered on December 7, 2025, through Dynadot Inc, with an SSL certificate issued by Let's Encrypt (YR1). As of the latest scan, only 2 out of 95 security vendors on VirusTotal have flagged the domain, suggesting it may still evade detection in some security tools. The infrastructure resolves to IP address 188.114.97.3, hosted on Amazon.com, Inc. (AS16509) in the United States, and appears on at least one security blocklist. The combination of recent registration, low detection rates, and active hosting indicates a deliberate effort to maintain operational stealth. Users who have visited veloraswap.xyz or interacted with its content should immediately revoke any wallet connections made through the site. Disconnect all authorized dApps via wallet settings and transfer assets to a new, secure wallet if suspicious activity is detected. Monitor transaction histories for unauthorized transfers and report the domain to relevant security teams for further mitigation. Avoid re-engaging with the site or any associated links, as the infrastructure remains active and may deploy additional malicious payloads.