velveroulette[.]website

Analysis as of July 25 2026 indicates that the domain velveroulette.website was registered on February 21 2026 through the registrar REGRU-RU. The authoritative nameservers are diva.ns.cloudflare.com and piotr.ns.cloudflare.com, and the domain resolves to the Cloudflare edge address 104.21.74.170, which is associated with ASN 13335 in the United States. No TLS certificate is presented, meaning traffic is served over plain HTTP. The site’s page title reads “Velveroulette: Most Popular Online Crypto Casino Based on Blockchain,” and the threat classification is a crypto‑related scam that uses the Gambler Scam phishing kit.

Ten of ninety‑three VirusTotal scanners flagged the host, and the domain is listed on a single external blocklist. PhishDestroy has already taken the site offline, and the Gridinsoft trust score is recorded as zero out of one hundred, reinforcing the malicious reputation. The evidence set shows that the infrastructure leverages Cloudflare’s CDN, which can obscure the true backend server, and the lack of SSL suggests an attempt to lower the cost of hosting while still appearing legitimate to unsuspecting victims. What remains uncertain includes the specific victim demographics, any command‑and‑control traffic, and whether additional phishing pages were hosted under the same certificate.

Defenders should block the domain at the DNS level, add the IP address 104.21.74.170 to network deny lists, and ensure that any outbound connections to Cloudflare edge nodes are inspected for anomalous HTTP payloads. Continuous monitoring of the registrar REGRU‑RU for new registrations and the associated nameservers is recommended, as they have been used in recent crypto‑scam campaigns. Organizations should also update URL filtering feeds with the observed blocklist entry and verify that endpoint protection solutions reflect the ten vendor detections reported by VirusTotal.