velmorazone[.]site

The domain velmorazone.site has been identified as a credential harvesting phishing site targeting users through deceptive activity reward schemes. Analysis confirms the domain is currently offline, though it previously hosted content impersonating a gaming or rewards platform under the guise of user leveling and withdrawal functionalities. The threat type is classified as generic phishing with a focus on credential theft, likely targeting users through social engineering tactics promising financial or in-game rewards. Infrastructure analysis reveals the domain was registered on March 05, 2026, through HOSTINGER operations, UAB, and resolved to the IP address 157.245.145.149. Security telemetry indicates the domain was flagged by 5 of 95 vendors on VirusTotal, with detection signatures focusing on phishing behavior. The domain appears on one security blocklist, specifically PhishDestroy, and was hosted on infrastructure utilizing Bootstrap, Nginx, Unpkg, jsDelivr, and HTTP/3 protocols. The page title, "Velmora — Mulai Aktivitas • Naik Level • Tarik Hasil," suggests a localized phishing campaign targeting Indonesian-speaking users, leveraging themes of activity tracking, level progression, and reward withdrawal. Current status confirms the domain is offline, though residual risk remains due to potential re-activation or migration to alternative infrastructure. Organizations are advised to block the domain and associated IP address 157.245.145.149 at the perimeter level. Endpoint protection systems should be updated to include detection rules for the domain and its known indicators. Users who may have interacted with the domain should be instructed to reset credentials for any accounts accessed during the exposure window, particularly if multi-factor authentication was not enabled. Monitoring for similar domains registered through the same registrar or resolving to the same IP range is recommended to preemptively mitigate related threats.